lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Apache Kafka

Apache Software Foundationother3 credentials

Credentials3 documented
01

SASL PLAIN / SCRAM Password

apache-kafka / sasl-plain-scram-password

Kafka supports SASL authentication mechanisms including PLAIN and SCRAM. Broker and client JAAS configuration often contains usernames and passwords for inter-broker, producer, consumer, and admin authentication.

user definedsecretusername/password

Looks like

pattern
pattern

Kafka JAAS login module containing username or password options

org\.apache\.kafka\.common\.security\.(?:plain|scram)\.[A-Za-z]+LoginModule\s+required[^;]*(?:username|password)=['"][^'"\r\n]+['"]
pattern

Kafka properties sasl.jaas.config value containing SASL credentials

sasl\.jaas\.config\s*=\s*[^\r\n]*(?:username|password)=['"][^'"\r\n]+['"]

Location

config file
server.properties, client.properties, producer.properties, consumer.properties, adminclient.properties, jaas.conf, kafka_server_jaas.conf, connect-distributed.properties

Kafka broker, client, and Connect SASL/JAAS configuration files

secret store

Kubernetes Secrets, cloud secret managers, CI/CD variables, and Kafka platform secrets

source code

Deployment manifests, Helm values, integration tests, client configs, and application repositories

logs

Broker startup logs, client debug output, and CI traces

public interface
tcp/9092

Kafka broker listener context

Notes

KAFKA_OPTS usually points to a JAAS file rather than containing a credential value directly, so it is not listed as a credential environment location.

02

SSL Keystore / Truststore Password

apache-kafka / ssl-keystore-password

Kafka TLS configuration uses keystore and truststore locations and passwords for brokers and clients. These protect private keys and trust material.

user definedsecretpassword

Looks like

pattern
pattern

Kafka server.properties or client.properties SSL store password

ssl\.(?:key|trust)store\.password\s*=\s*[^\r\n]+
pattern

Kafka private key password setting

ssl\.key\.password\s*=\s*[^\r\n]+

Location

config file
server.properties, client.properties, producer.properties, consumer.properties, connect-distributed.properties

Kafka broker, client, and Kafka Connect TLS configuration

secret store

Java keystores, Kubernetes Secrets, cloud secret managers, and deployment vaults

source code

Committed client configs, Helm values, and container build contexts

image

Broker or client images containing keystores and config files

logs

Startup logs and SSL troubleshooting output

03

Kafka Connect Connector Secret

apache-kafka / connect-connector-secret

Kafka Connect connector configurations frequently include passwords, tokens, and API keys for source and sink systems.

user definedsecretsecret value

Looks like

pattern
pattern

Connector config secret assignment; use only with Kafka Connect connector config context

(?i)(password|secret|token|api[_-]?key)\s*[=:]\s*[^\s,}\]]{6,255}

Location

config file
connect-distributed.properties, connect-standalone.properties, connector.json, sink.json, source.json

Connector JSON/properties files and worker config

http response

Kafka Connect REST API responses containing connector configs when secrets are not masked

secret store

ConfigProvider backends, Kubernetes Secrets, cloud secret managers, and CI/CD variables

source code

Connector repositories, tests, and committed connector definitions

logs

Connector task logs and REST API traces

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.