In this lesson, we'll explore
how to use TruffleHog for detecting sensitive information
in source code repositories.
TruffleHog is a powerful tool
designed to help penetration testers
and security professionals find sensitive data
such as secrets, API keys, passwords,
and other sensitive information in the history
of a Git repository.
This tool is invaluable when assessing the security
of organizational codebases.
It can be used for Git, GitHub, GitLab, filesystems,
S3 buckets, GCS buckets, Docker images, and more.
The main purpose of TruffleHog is to scan the commit history
of Git repositories to uncover sensitive information
that may have been accidentally committed.
This is crucial in identifying
and mitigating the risk of secret leaks
which could lead to unauthorized access or data breaches.
To run TruffleHog against the local Git repository,
you'll use a command similar to the following:
trufflehog git, and then we're going to have
the path to the local repository.
In this command, replace /pathtolocalrepo
with the actual path of the Git repository
that you want to scan.
TruffleHog will scan the repository
and its commit history for potential secrets.
Imagine you are a penetration tester
hired to assess the security
of a company's internal applications.
The company provides you with the access
to their local Git repositories, and your task is to ensure
no sensitive information is exposed.
First, navigate to the directory
containing the local Git repository.
Then, run TruffleHog with the following command:
trufflehog git /home/user/
projects/company_repo
This is just an example of what the command will look like.
As TruffleHog scans the repository,
it will output any findings directly to your terminal.
The output will include the commit hash,
file path, and suspected secret.
We can also use TruffleHog for external repositories
that we can reach with a URL.
For example, we can use the command trufflehog git
https://github.com/
trufflesecurity/test_keys
Now, this is the output you will receive from that.
Here, we discovered
two verified AWS access keys in the repository.
These keys are identified as sensitive information
because they can grant access to AWS services
if they were real and not canary tokens.
Now, a canary token can be used to track
the behavior of cyber criminals.
They are implanted in regular files,
and when a user accesses a file or executes a process,
a message is sent to the person who implanted the token.
Now, if we were conducting a pentest in an AWS environment,
and these were real AWS keys,
they could be used to conduct further attacks.
We can use these keys to configure
their AWS command line interface
or software development kit,
allowing us to make API calls to the AWS environment
associated with the keys.
We would then be able to list, read,
create, or delete resources,
effectively gaining unauthorized access to sensitive data
stored in services like S3, DynamoDB, or RDS.
After that, we could also pivot within the AWS environment
to discover and exploit additional vulnerabilities
or misconfigurations, leading to further compromise
and data exfiltration.
So, remember, TruffleHog is a critical tool
for discovering sensitive information and code repositories.
By scanning commit histories and identifying secrets,
API keys, or passwords, it helps ensure that sensitive data
is not accidentally exposed.