Hacker disclosed GitHub secret key hunter – TruffleHog

A tool for finding secret keys with varying cryptographic strength in github repositories is published by Dylan Ayrey.

The tool, named as TruffleHog, can search for and find keys containing high-entropy strings by digging deep into commit history and branches, as per developer

TruffleHog’s search capabilities make it “effective at finding secrets accidentally committed that contain high entropy,” Ayrey says, and the tool needs nothing more than GitPython to work.

Ayrey commented:

This module will go through the entire commit history of each branch, and check each diff from each commit, and evaluate the Shannon entropy for both the base64 character set and hexidecimal character set for every blob of text greater than 20 characters comprised of those character sets in each diff.

TruffleHog calculates entropy levels using a Shannon Entropy (.PDF) calculator. The entropy levels of keys are important, as the information required to decide unknown key variables can alter how difficult it is to crack.

If a high-entropy string is detected, the string is printed to the screen.

Users of TruffleHog said in a Reddit discussion topic that Amazon already uses the tool to preemptively search GitHub for Amazon Web Services (AWS) keys accidentally connected to public repositories, which prevents attackers from snatching the keys, spinning up vast AWS instances and leaving the owners with the bill.


GitPython is the only requirement, which can be installed with the following

pip install -r requirements.txt

How to use Truffle Hog:

python truffleHog.py https://github.com/dxa4481/truffleHog.git

Why the name Truffle Hog?

Truffle Hog is a domestic pig used for locating and extracting a type of tuber known as truffles from temperate forests in Europe and North America. The pigs have a good sense of smell and can find truffles from as deep as three feet underground.

It is thought that the natural sex hormones of the male pig are like the smell of the truffles and pigs have a natural affinity for rooting in the earth for food. They are trained to hunt truffles by walking on a leash through suitable groves with a keeper.

Kesavan D

Recent Posts

Burp Suite 2023.6 Released – What’s New!

PortSwigger released a brand-new version of Burp Suite 2023.6 that is intended for both Professional…

17 hours ago

North Korean Hackers Mimic Journalists To Steal Credentials From Organizations

The North Korean APT group Kimsuky has been running a social engineering operation that targets experts…

1 day ago

Over 60,000 Android Apps Silently Install Malware on Devices

Recently, cybersecurity researchers uncovered that over 60,000 Android applications had been stealthily disguised as genuine…

1 day ago

Google Chrome Zero-Day Vulnerability Exploited Widely – Urgent Update

Google has recently taken prompt security measures by releasing a security update for its Chrome…

2 days ago

MOVEit Hack – BBC, British Airways Employees Contact and Financial Data Exposed

A major MOVEit Hack has impacted many businesses, notably the BBC, British Airways, Boots, and…

2 days ago

10 Best Vulnerability Scanner Tools For Penetration Testing – 2023

A Vulnerability Scanner Tools is one of the essential tools in IT departments Since vulnerabilities…

2 days ago