Let's take another case to look at searching for the compromise of API key information. An API key being hardcoded in the source code or a password being weakly encrypted in the source code are both common security vulnerabilities. To search for a private encryption key or hardcoded password requires the calculation of entropy which is a number to represent the level of randomness. A string with a high entropy value is normally an indicator of a potential API key, hash value, or encrypted message. In the following demonstration, we will also use the vulnerable Python API project to search for vulnerable API keys in the source code. The tools we will be using are entropy.py and DumpsterDiver. To download the script, execute the following command:
$ git clone https://github.com/securing/DumpsterDiver
