Secret Shapes

API keys, tokens, PEM blocks — recognize shapes; keep them out of YOUR $REPO.

Secret Shapes• Audio Walkthrough

00:00/02:49

Visual · t17_secret_shapes

Secrets have recognizable patterns — and belong in vaults, not git. Original Cyberlium.

AWS AKIA… in a commit is not a learning moment for the internet — it is a rotation incident.

Hardcoded secrets appear as high-entropy strings, provider prefixes (AKIA, ghp_, sk_live_), PEM headers (BEGIN PRIVATE KEY), JWT eyJ segments, and connection strings with passwords. Learn shapes to catch mistakes in YOUR code before push — never go hunting for live keys in stranger repos, paste sites, or breach dumps to 'practice.' Use environment variables, secret managers, and.gitignore for local.env on $REPO. If you accidentally commit a test key, rotate immediately — do not assume private repo means safe.

1. Common shapes

Cloud access keys, OAuth client secrets, database URLs, private keys, webhook HMAC secrets.

Provider docs list prefix patterns — use for review checklists.

Command guide

Try these commands — Common shapes

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: grep, python3. Reference sites: Secrets management (https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html); CWE-798 (https://cwe.mitre.org/data/definitions/798.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.