for %%A in (%*) do ( set "ARG=%%~A" rem --extensions= echo "!ARG!" | findstr /i /b "--extensions=" >nul if !errorlevel! equ 0 ( for /f "tokens=1* delims==" %%K in ("!ARG!") do set "EXTS=%%L" ) echo "!ARG!" | findstr /i /b "--exclude=" >nul if !errorlevel! equ 0 ( for /f "tokens=1* delims==" %%K in ("!ARG!") do set "EXCLUDE=%%L" ) if /i "!ARG!"=="--mask" set "MASK=1" if /i "!ARG!"=="--dry-run" set "DRY=1" )
:: -------------------------- :: Patterns to look for :: As batch lacks regex, we use findstr with /r and some heuristics :: -------------------------- REM Common patterns (simplified): REM - AWS Access Key ID: AKIA followed by 16 alphanumerics REM - AWS Secret Access Key: 40 base64-like chars (heuristic) REM - Google API key: "AIza" followed by 35 chars REM - JWT-like: three base64url segments separated by dots, present in a line REM - UUIDs: 8-4-4-4-12 hex pattern REM - Generic tokens: long alphanumeric strings >= 20 chars REM - Private key headers: -----BEGIN PRIVATE KEY----- get-keys.bat
@echo off REM get-keys.bat REM Recursively search for likely keys/tokens in files and generate a CSV report. REM Usage: REM get-keys.bat [root_path] [--extensions=ext1,ext2,...] [--exclude=pattern1;pattern2] [--mask] [--dry-run] REM Defaults: REM root_path = current directory REM extensions = txt,env,conf,config,json,js,py,java,xml,ini,yml,yaml,md,log REM exclude = .git;.venv;node_modules;venv REM mask = redact found values in report REM dry-run = do not write report (only console output) for %%A in (%*) do ( set "ARG=%%~A" rem --extensions= echo "
REM build file list using for /R and extension filtering, skipping excludes for /R "%ROOT%" %%F in (%EXT_FILTER%) do ( set "FILE=%%~fF" REM check exclude patterns set "SKIP=0" for %%X in (%EXCLUDE:;= %) do ( echo "!FILE!" | findstr /i /c:"\\%%X\\" >nul if !errorlevel! equ 0 set "SKIP=1" ) if "!SKIP!"=="1" ( REM skip ) else ( REM Read file line by line set "LN=0" for /f "usebackq delims=" %%L in ("%%~fF") do ( set /a LN+=1 set "LINE=%%L" setlocal ENABLEDELAYEDEXPANSION set "L=!LINE!" endlocal & set "L=%L%" REM Quick presence checks for patterns to avoid expensive checks on every line echo "%L%" | findstr /i "AKIA AIza -----BEGIN PRIVATE KEY-----" >nul set "P1=%errorlevel%" echo "%L%" | findstr /r /c:"[A-Fa-f0-9]\8\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\12\" >nul set "P2=%errorlevel%" REM Generic long token heuristic: sequences of 20+ alnum or -_ characters echo "%L%" | findstr /r /c:"[A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-]" >nul set "P3=%errorlevel%" if "%P1%"=="0" (set "MATCHFOUND=1") else if "%P2%"=="0" (set "MATCHFOUND=1") else if "%P3%"=="0" (set "MATCHFOUND=1") else set "MATCHFOUND=0" REM Usage: REM get-keys