Get-keys.bat Apr 2026

Below is a thorough, extensible Windows batch script named get-keys.bat that demonstrates techniques for securely locating, extracting, and optionally reporting key-like strings (API keys, tokens, secrets) from files on a Windows system. This is intended for legitimate use only — e.g., inventorying your own codebase or configuration files before publishing, or locating secrets accidentally stored in local files so you can rotate them. Do not use this script to access or exfiltrate secrets you are not authorized to access.

:: -------------------------- :: Patterns to look for :: As batch lacks regex, we use findstr with /r and some heuristics :: -------------------------- REM Common patterns (simplified): REM - AWS Access Key ID: AKIA followed by 16 alphanumerics REM - AWS Secret Access Key: 40 base64-like chars (heuristic) REM - Google API key: "AIza" followed by 35 chars REM - JWT-like: three base64url segments separated by dots, present in a line REM - UUIDs: 8-4-4-4-12 hex pattern REM - Generic tokens: long alphanumeric strings >= 20 chars REM - Private key headers: -----BEGIN PRIVATE KEY-----

REM build file list using for /R and extension filtering, skipping excludes for /R "%ROOT%" %%F in (%EXT_FILTER%) do ( set "FILE=%%~fF" REM check exclude patterns set "SKIP=0" for %%X in (%EXCLUDE:;= %) do ( echo "!FILE!" | findstr /i /c:"\\%%X\\" >nul if !errorlevel! equ 0 set "SKIP=1" ) if "!SKIP!"=="1" ( REM skip ) else ( REM Read file line by line set "LN=0" for /f "usebackq delims=" %%L in ("%%~fF") do ( set /a LN+=1 set "LINE=%%L" setlocal ENABLEDELAYEDEXPANSION set "L=!LINE!" endlocal & set "L=%L%" REM Quick presence checks for patterns to avoid expensive checks on every line echo "%L%" | findstr /i "AKIA AIza -----BEGIN PRIVATE KEY-----" >nul set "P1=%errorlevel%" echo "%L%" | findstr /r /c:"[A-Fa-f0-9]\8\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\12\" >nul set "P2=%errorlevel%" REM Generic long token heuristic: sequences of 20+ alnum or -_ characters echo "%L%" | findstr /r /c:"[A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-]" >nul set "P3=%errorlevel%" if "%P1%"=="0" (set "MATCHFOUND=1") else if "%P2%"=="0" (set "MATCHFOUND=1") else if "%P3%"=="0" (set "MATCHFOUND=1") else set "MATCHFOUND=0" get-keys.bat

:: -------------------------- :: Main scan loop :: -------------------------- pushd "%ROOT%" 2>nul || (echo Cannot access %ROOT% & exit /b 1)

:: Write CSV header set "CSV_HDR=File,LineNumber,Context,MatchType,MatchValue" if "%DRY%"=="0" ( echo %CSV_HDR%> "%OUTFILE%" ) Below is a thorough, extensible Windows batch script

call :mask_value "%MATCHVAL%" set "OUTVAL=%MASKED_VALUE%" REM Quote fields for CSV, replace quotes inside fields set "QFILE=%%~fF" set "QLINE=%LN%" set "QCTX=%L%" REM escape double quotes by doubling them set "QFILE=%QFILE:"=""%" set "QCTX=%QCTX:"=""%" if "%DRY%"=="0" ( >>"%OUTFILE%" echo "%QFILE%","%QLINE%","%QCTX%","%MT%","%OUTVAL%" ) echo Found [%MT%] in %%~fF:%LN% -> %OUTVAL% ) ) ) )

if "%DRY%"=="0" ( echo Report written to %OUTFILE% ) else ( echo Dry-run complete: no report written. ) :: -------------------------- :: Patterns to look for ::

set "OUTFILE=%CD%\get-keys_report_%DT%.csv"