Day 6: Automated Vulnerability Scanning with Nuclei & GitHub Reconnaissance / Secret Hunting

1. The Shift to Automation: Manual vs. Automated Scanning

Throughout Days 1 through 5 of the BugXploit workshop, every phase of penetration testing was conducted manually: discovering live hosts with ARP and Nmap, crafting targeted netcat queries against daemon banners, intercepting raw HTTP streams with Burp Suite Proxy, manually configuring Intruder payload markers, and injecting precision payloads for SQL injection, Command Injection, and Cross-Site Scripting (XSS).

While manual testing gives a penetration tester an unmatched understanding of protocol semantics and application logic, modern enterprise perimeters and cloud-native applications contain thousands of microservices, third-party libraries, and disparate network daemons. Manually checking every known vulnerability against every open port is operationally impossible.

Automated vulnerability scanners bridge this gap by rapidly querying target infrastructure against large, community-curated template repositories. On Day 6, the workshop shifted gears from purely manual exploitation to industrial-grade automation using Nuclei by ProjectDiscovery, paired with modern GitHub Reconnaissance and Secret Hunting.

2. ProjectDiscovery Nuclei Architecture & Upgrades

Nuclei is a fast, template-driven vulnerability scanner written in Go by ProjectDiscovery. Unlike heavyweight legacy scanners that rely on rigid, closed-source engines, Nuclei is completely modular:

• YAML-Based Templates: Every test (HTTP, TCP, DNS, SSL, Websocket, Whois, Javascript, Headless browser) is defined in a human-readable YAML document specifying request parameters, matchers, extractors, and payload conditions.
• Protocol Clustering: Nuclei analyzes loaded templates and clusters identical requests together. If 50 different templates target /dvwa/login.php, Nuclei groups them into a single HTTP connection, drastically reducing network overhead and preventing target server exhaustion.
• Out-of-Band (OAST) Integration: Native integration with Interactsh (e.g., oast.online) allows Nuclei to detect Blind RCE, Blind SSRF, and DNS exfiltration without exposing the tester's external IP address.

Prior to initiating any automated assessment in Kali Linux, both the Nuclei binary and its community template library must be brought to the latest upstream release to ensure detection of newly disclosed zero-days and signature improvements.

3. Authenticated Scanning: Passing Session Cookies & Headers

Unauthenticated vulnerability scanners only inspect public landing pages (such as login.php or the web server default page). Vulnerabilities residing behind login portals—such as internal administration dashboards, command injection forms, file uploaders, or SQL injection vectors—remain invisible unless the scanner is supplied with a valid session state.

In DVWA, users must authenticate with admin:password and maintain an active PHP session. Furthermore, DVWA maintains an internal security state cookie (security=low). To scan the application from the perspective of an authenticated, low-privilege user, we pass the custom session cookie directly into Nuclei using the -H (Header) flag and record all output to dvwa_results.txt.

4. Live Terminal Execution & Scan Output Breakdown

Upon launching the scan, Nuclei loaded 10,730 templates, executed intelligent clustering (collapsing 2,336 duplicate requests), engaged its Interactsh engine, and completed the scan in approximately 3 minutes, returning 69 actionable vulnerability matches across HTTP, TCP, and Javascript protocols:

5. In-Depth CVE Analysis: PHP-CGI, Samba & DistCC

A critical skill taught in BugXploit's workshop is translating raw scanner output into verified, actionable vulnerability assessments. Scanners output flags, but an ethical hacker must understand the underlying technical mechanics and exploitation vector.

6. Default Credentials & Weak Service Auditing (Postgres, VNC, FTP)

Beyond software vulnerabilities, misconfigured credentials and forgotten administrative accounts represent the easiest access vector for threat actors. Nuclei automatically executed dictionary checks and service handshakes against non-HTTP ports:

7. Terminal Verification: vsftpd 2.3.4 & Anonymous Access

To prove that automated scanner outputs are accurate and not false positives, we returned to our terminal in Kali Linux and executed a manual TCP connection against port 21 using the native ftp client:

The banner 220 (vsFTPd 2.3.4) and 230 Login successful verified Nuclei's finding in under five seconds. In Day 2, we learned this exact daemon contains the smiley face backdoor (:)) triggering a root shell on port 6200. Nuclei flagged this daemon with both CVE-2015-1419 (Denial of Service) and CVE-2021-30047.

8. Web Defense Gap: Missing HTTP Security Headers

Nuclei reported 10 critical security headers missing from DVWA's HTTP responses. While developers often overlook response headers, their absence strips modern browsers of their built-in security defenses:

9. GitHub Reconnaissance & Sensitive Token Dorking

While network and web scanners probe perimeter infrastructure, modern security breaches increasingly originate from source code repositories. Developers routinely commit secrets, database passwords, private encryption keys, and third-party SaaS tokens to public repositories by accident.

GitHub Dorking is the process of using GitHub's specialized search syntax to locate inadvertently committed credentials:

Finding a secret on GitHub is only the first step. In an ethical penetration test or bug bounty assessment, researchers must prove impact without modifying or corrupting customer data. This is where Keyhacks becomes essential.

10. Deep Dive: streaak/keyhacks & API Key Validation

The open-source repository streaak/keyhacks is an industry-standard playbook maintained by security researcher Streaak. It provides verified, non-destructive API calls to validate whether an exposed credential is valid, determine its scope and permissions, and demonstrate exploitability safely.

Below are key examples of how ethical hackers test leaked API keys using curl commands documented in Keyhacks:

aws sts get-caller-identity --access-key-id <AWS_ACCESS_KEY> --secret-access-key <AWS_SECRET_KEY>

curl https://api.stripe.com/v1/charges -u sk_live_xxxxxxxxxxxxxxxxxxxx:

curl -G https://api.twilio.com/2010-04-01/Accounts/ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/Messages.json \
  -u ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:your_auth_token

curl -i "https://maps.googleapis.com/maps/api/directions/json?origin=Disneyland&destination=Universal+Studios+Hollywood&key=AIzaSyxxxxxxxxxxxx"

curl -X POST -H 'Authorization: Bearer xoxb-xxxxxxxxxxxx' https://slack.com/api/auth.test

11. Advanced Secret Hunting: iscan.today, Benji Trapp & TruffleHog

During the session, the instructors introduced three specialized tools and repositories that streamline GitHub reconnaissance:

How TruffleHog Works

Developers often think that deleting a sensitive file in a subsequent commit fixes a leak:

git rm .env && git commit -m "Removed credentials" && git push

However, git is an immutable version control history. The secret remains permanently readable in past commit snapshots. TruffleHog iterates through every single branch, tag, and commit diff in the repository:

trufflehog github --repo https://github.com/organization/target-repository

When TruffleHog discovers a candidate key, it conducts an out-of-band verification against the service provider (e.g., querying the AWS STS endpoint or Slack API) and displays a green [VERIFIED] badge, instantly confirming whether the credential is still active.

12. Defensive Engineering: Pre-Commit Hooks & Secret Hygiene

Securing source code and protecting modern infrastructure requires shifting security left into the software development life cycle (SDLC):

1. Pre-Commit Hooks: Implement tools like git-secrets, Gitleaks, or pre-commit hooks locally on developer machines. If a developer attempts to commit code containing an API key pattern (e.g., AKIA... or sk_live_...), the commit is automatically blocked locally before touching git remotes.
2. CI/CD Secret Scanners: Integrate TruffleHog or GitHub Secret Scanning into GitHub Actions. Any pull request containing hardcoded credentials immediately fails automated builds.
3. Centralized Secret Management: Never store credentials in flat text or source files. Store runtime configuration in secure vaults such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault, injected strictly at runtime via environment variables.
4. Credential Revocation & Rotation: Treat any key pushed to a public repository as compromised immediately. Rotate the credential, revoke the compromised key pair, and review cloud audit logs (such as AWS CloudTrail) for unauthorized access attempts.

13. Day 6 Summary & Key Takeaways

14. Curated Pentesting & Secret Hunting Resources

To accelerate security assessments and automated reconnaissance, here is a curated repository list of cutting-edge tools and attack playbooks referenced during our training sessions: