asmhatreandClaude Sonnet 5.5
1497fba911
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017ic4b6tTs7ivgTNq4ZrurU
13 lines
688 B
Plaintext
13 lines
688 B
Plaintext
1. the jar: src/main/resources/application-leaky.yml (a deliberately committed secret) as packaged
|
|
$ unzip -p target/secrets-1.0.0.jar BOOT-INF/classes/application-leaky.yml | grep password
|
|
password: hunter2-committed-to-git
|
|
2. command-line argument, as any user on the host sees it
|
|
$ ps -o args= -p <pid> | tr ' ' '\n' | grep db.password
|
|
--db.password=arg-secret-789
|
|
3. environment variables, readable by the same user
|
|
$ tr '\0' '\n' < /proc/<pid>/environ | grep -E 'DB_PASSWORD_FROM_ENV|SIGNING_KEY'
|
|
DB_PASSWORD_FROM_ENV=env-secret-123
|
|
SIGNING_KEY=env-signing-key-456
|
|
4. /proc/<pid>/cmdline, what the kernel keeps of the arguments
|
|
--db.password=arg-secret-789
|