Friday, March 29, 2024

Hacker disclosed GitHub secret key hunter – TruffleHog

A tool for finding secret keys with varying cryptographic strength in github repositories is published by Dylan Ayrey.

The tool, named as TruffleHog, can search for and find keys containing high-entropy strings by digging deep into commit history and branches, as per developer

TruffleHog’s search capabilities make it “effective at finding secrets accidentally committed that contain high entropy,” Ayrey says, and the tool needs nothing more than GitPython to work.

Ayrey commented:

This module will go through the entire commit history of each branch, and check each diff from each commit, and evaluate the Shannon entropy for both the base64 character set and hexidecimal character set for every blob of text greater than 20 characters comprised of those character sets in each diff.

TruffleHog calculates entropy levels using a Shannon Entropy (.PDF) calculator. The entropy levels of keys are important, as the information required to decide unknown key variables can alter how difficult it is to crack.

If a high-entropy string is detected, the string is printed to the screen.

Users of TruffleHog said in a Reddit discussion topic that Amazon already uses the tool to preemptively search GitHub for Amazon Web Services (AWS) keys accidentally connected to public repositories, which prevents attackers from snatching the keys, spinning up vast AWS instances and leaving the owners with the bill.

Setup:

GitPython is the only requirement, which can be installed with the following

pip install -r requirements.txt

How to use Truffle Hog:

python truffleHog.py https://github.com/dxa4481/truffleHog.git

hacker have disclosed GitHub secret keys
Why the name Truffle Hog?

Truffle Hog is a domestic pig used for locating and extracting a type of tuber known as truffles from temperate forests in Europe and North America. The pigs have a good sense of smell and can find truffles from as deep as three feet underground.

It is thought that the natural sex hormones of the male pig are like the smell of the truffles and pigs have a natural affinity for rooting in the earth for food. They are trained to hunt truffles by walking on a leash through suitable groves with a keeper.

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles