Skip to content
Nirmal Dahal

Security research

GHDB-ID 4997: finding exposed application secrets

2018

Context

Misconfigured deployments sometimes publish their environment files, exposing application keys and debug settings to anyone with a search engine.

Approach

  1. 1Wrote a search query that finds publicly indexed .env files containing application settings
  2. 2Submitted it to Exploit-DB's Google Hacking Database so defenders can check their own exposure

Outcome

Published as GHDB-ID 4997 on 24 October 2018 in the “Files Containing Juicy Info” category.

Next case note

National Cyber Drill, March 2025

All case notes
Training and exercise · 2025A four-day national exercise for engineers, officers and directors from about 30 government agencies, held 20 to 23 March 2025 (2082 BS).Read it

Want this kind of work on your systems?

Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.

Book a 30-minute callSend a message