trufflehog

by trufflesecurity

24.7Kstars

2.2Kforks

196watchers

Updated about 1 month ago

About

TruffleHog is a powerful tool to discover, classify, validate, and analyze leaked credentials across various platforms and repositories.

Find, verify, and analyze leaked credentials

Primary Use Case

TruffleHog is primarily used by security teams and developers to identify exposed secrets such as API keys, passwords, and private keys in source code, chats, wikis, and other data stores. It helps organizations proactively detect and validate leaked credentials to prevent unauthorized access and potential breaches.

Key Features

Discovery of secrets across Git, chats, wikis, logs, API testing platforms, object stores, and filesystems
Classification of over 800 secret types mapped to their specific identities
Validation of secrets by checking if they are live and active
In-depth analysis of common leaked credentials to determine creation, access, and permissions
Supports scanning multiple platforms including GitHub, Jira, Slack, Confluence, Microsoft Teams, and Sharepoint
Open source with an enterprise version for continuous monitoring
Docker support for easy deployment
Community support via Slack and Discord

Installation

For MacOS users: brew install trufflehog
Ensure Docker engine is running before using Docker commands
Unix Docker run: docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys
Windows Command Prompt Docker run: docker run --rm -it -v "%cd:/=\=%:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys
Windows PowerShell Docker run: docker run --rm -it -v "${PWD}:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys

Usage

>_ docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --org=trufflesecurity

Run TruffleHog via Docker to scan all repositories in the 'trufflesecurity' GitHub organization.

>_ docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys

Run TruffleHog via Docker to scan a specific GitHub repository for leaked secrets.

Security Frameworks

Discovery

Collection

Credential Access

Reconnaissance

Defense Evasion

Usage Insights

Integrate TruffleHog scans into CI/CD pipelines for early detection of leaked secrets before deployment.
Use the validation feature to prioritize remediation efforts by focusing on active and live credentials.
Combine with SIEM tools to automate alerting and incident response workflows upon secret detection.
Leverage classification data to tailor access control policies and reduce attack surface.
Employ TruffleHog in purple team exercises to simulate credential leakage scenarios and improve detection capabilities.