Simple PowerShell functions to help finding secrets on Azure DevOps.
org - Azure DevOps organization name
project - Azure DevOps project name
token - PAT, JWT or base64-encoded JWT
pattern[s] - what strings to look for in the output
maxruns - maximum number of pipeline runs to enumerate
maxitems - maximum number of results to enumerate
maxsteps - maximum number of steps to enumerate per pipeline run
maxartifacts - maximum number of piplines with artifacts to retrieve
target - name pattern of pipeline folder / pipeline / repository
startid - ID of specific object, starting point, decremented
pipelineid - ID of specific pipeline to enumerate
outputdir - output folder for results
query - query to execute on search engine
skip - used to skip pipelines below that number during enumeration
Invoke-ADOSecretsHunter -org "OrgName" -project "ProjectName" -token "XXX" -patterns "passw","pwd" -maxruns 5 -target "NamePattern" -outputDir "C:\Temp"
Download-ADOPipelineArtifacts -org "OrgName" -project "ProjectName" -token "XXX" -maxruns 100 -pipelineid 11111 -outputdir "C:\Temp"
Search-ADOAllWorkitemsSecrets -org "OrgName" -project "ProjectName" -token "XXX" -patterns "passw","pwd" -startid 11111 -maxitems 100
Search-ADOAllRunsSecrets -org "OrgName" -project "ProjectName" -token "XXX" -patterns "passw","pwd" -maxruns 100 -maxsteps 10 -startid 11111
Search-ADORepoPipelinesSecrets -org "OrgName" -project "ProjectName" -token "XXX" -patterns "passw","pwd","token" -maxruns 100 -maxsteps 10 -target "NamePattern"
Search-ADOPipelineSecrets -org "OrgName" -project "ProjectName" -token "XXX" -patterns "passw","pwd" -maxruns 100 -maxsteps 10 -pipelineid 11111
Search-ADORepoSecrets -org "OrgName" -project "ProjectName" -token "XXX" -query "password" -maxitems 100
Disclaimer
This repository contains tool developed strictly for educational purposes. Any misuse of the tool for illegal activities is strictly prohibited.
Legal Notice
It is important to understand and comply with all local laws and regulations related to cybersecurity and ethical hacking. Unauthorized access to computer systems, networks, or data is illegal and punishable by law. The developer of this repository is not responsible for any misuse of the tools contained herein.
By using the tools in this repository, you agree to use them responsibly and ethically. Always obtain explicit permission before testing or attempting to access any network, system, or data that does not belong to you.