---
description: Loot processing — sort, validate, deduplicate credentials/data
---

# Process Loot

## Steps

// turbo-all

1. **Read Loot File**
   ```
   find_by_name: loot*, results*, credentials*, dump*
   view_file on found files
   ```

2. **Parse & Categorize**
   Sort loot by type:
   - Database credentials (MySQL, PostgreSQL, MongoDB)
   - API keys (AWS, GCP, Azure, Stripe, SendGrid)
   - Email:password combos
   - Session cookies/tokens
   - Private keys / certificates

3. **Deduplicate**
   Remove exact duplicates and near-duplicates.

4. **Validate (Read-Only)**
   For each credential type, validate WITHOUT modifying:
   - AWS: `sts:GetCallerIdentity`
   - API keys: check key format validity
   - URLs: verify accessibility (HEAD request)
   - Emails: format validation only

5. **Score & Prioritize**
   Assign value score:
   - Admin credentials → HIGH
   - Cloud keys with write access → HIGH
   - Read-only keys → MEDIUM
   - Expired/invalid → DISCARD

6. **Report**
   Generate secure artifact with:
   - Stats (total, valid, invalid, by type)
   - High-value items highlighted
   - Recommended next steps