← retour aux outils back to tools

# TruffleHog

Recherche des secrets exposés, clés API, credentials et clés privées dans les dépôts git, systèmes de fichiers, buckets S3 et CI/CD, via analyse d'entropie et patterns regex. Searches git repositories, filesystems, S3 buckets, and CI/CD for exposed secrets, API keys, credentials, and private keys using entropy analysis and regex patterns.

↗ https://github.com/trufflesecurity/trufflehog

## Overview

TruffleHog finds secrets in git history, code repositories, filesystems, and cloud storage. It uses 800+ detectors with verified credential checking (checks if the found API key is actually valid) for services like AWS, GitHub, Slack, Twilio, and hundreds more.

## Basic Usage

Scan a git repository (local or remote)

    trufflehog git https://github.com/target/repo

Scan local directory

    trufflehog filesystem /path/to/code/

Scan GitHub organization

    trufflehog github --org=TargetOrg

Scan a single GitHub repo

    trufflehog github --repo=https://github.com/target/repo

Scan S3 bucket

    trufflehog s3 --bucket=mybucket

Scan Docker image

    trufflehog docker --image=my/image:latest

Scan GCS bucket

    trufflehog gcs --project-id=my-project --cloud-environment

## Git Scanning

Scan entire git history (all commits)

    trufflehog git https://github.com/target/repo --no-verification

Only verified secrets (confirmed valid credentials)

    trufflehog git https://github.com/target/repo --only-verified

Scan with authentication (private repo)

    trufflehog git https://github.com/target/repo \
      --token=ghp_your_github_token

Scan all branches

    trufflehog git https://github.com/target/repo --include-detectors=all

Scan specific branch

    trufflehog git https://github.com/target/repo --branch main

Scan since specific commit

    trufflehog git https://github.com/target/repo --since-commit abc123

## GitHub Organization Scanning

Scan all public repos in an org

    trufflehog github --org=TargetCorp --token=ghp_token

Include private repos (needs appropriate token permissions)

    trufflehog github --org=TargetCorp --token=ghp_token --include-repos=private

Exclude specific repos

    trufflehog github --org=TargetCorp --token=ghp_token \
      --exclude-repos=archived-repo,test-repo

## Output & Filtering

JSON output

    trufflehog git https://github.com/target/repo --json

Only print specific detector findings

    trufflehog git url --only-verified --include-detectors=AWS,GitHub,Slack

Exclude specific detectors

    trufflehog git url --exclude-detectors=generic

Save output

    trufflehog git url --json 2>&1 | tee findings.json

## What TruffleHog Detects

Common detector categories:

- AWS: Access keys, secret keys, session tokens
- GitHub/GitLab: Personal access tokens, OAuth tokens
- Google: API keys, service account credentials
- Slack: API tokens, webhooks
- Stripe: API keys (live and test)
- Twilio: Auth tokens
- SendGrid: API keys
- Generic: High-entropy strings, private keys (PEM/PGP)

## CI/CD Integration

    # GitHub Actions
    - name: TruffleHog Scan
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        base: ${{ github.event.repository.default_branch }}
        head: HEAD
        extra_args: --only-verified

    # Pre-commit hook
    cat > .git/hooks/pre-commit << 'EOF'
    #!/bin/bash
    trufflehog git file://. --since-commit HEAD --only-verified --fail
    EOF
    chmod +x .git/hooks/pre-commit

## Tips

- `--only-verified` dramatically reduces false positives by actually testing credentials
- Always scan git history — secrets are often deleted from current code but remain in history
- The `--json` flag is essential for programmatic processing of results
- Run against GitHub organizations during OSINT: developers often accidentally commit secrets

Help / Man page

    trufflehog <source> [options]

    Sources:
      git URL            Git repository
      github             GitHub repos/orgs
      gitlab             GitLab repos
      filesystem PATH    Local directory
      s3                 AWS S3 bucket
      gcs                Google Cloud Storage
      docker             Docker image
      circleci           CircleCI
      travisci           Travis CI

    Common options:
      --only-verified    Only report verified/valid secrets
      --no-verification  Skip credential verification
      --include-detectors  Comma-separated detector list
      --exclude-detectors  Detectors to skip
      --json             JSON output
      --since-commit HASH  Scan from specific commit
      --branch BRANCH    Specific branch
      --token TOKEN      Auth token for private repos
      --fail             Exit with error code if secrets found

## Vue d’ensemble

TruffleHog trouve des secrets dans l’historique git, les dépôts de code, les systèmes de fichiers et le stockage cloud. Il utilise plus de 800 détecteurs avec vérification des credentials (vérifie si la clé API trouvée est réellement valide) pour des services comme AWS, GitHub, Slack, Twilio, et des centaines d’autres.

## Utilisation de base

    # Scanner un dépôt git (local ou distant)
    trufflehog git https://github.com/target/repo

    # Scanner un répertoire local
    trufflehog filesystem /path/to/code/

    # Scanner une organisation GitHub
    trufflehog github --org=TargetOrg

    # Scanner un seul dépôt GitHub
    trufflehog github --repo=https://github.com/target/repo

    # Scanner un bucket S3
    trufflehog s3 --bucket=mybucket

    # Scanner une image Docker
    trufflehog docker --image=my/image:latest

    # Scanner un bucket GCS
    trufflehog gcs --project-id=my-project --cloud-environment

## Scan Git

    # Scanner tout l'historique git (tous les commits)
    trufflehog git https://github.com/target/repo --no-verification

    # Uniquement les secrets vérifiés (credentials valides confirmés)
    trufflehog git https://github.com/target/repo --only-verified

    # Scanner avec authentification (dépôt privé)
    trufflehog git https://github.com/target/repo \
      --token=ghp_your_github_token

    # Scanner toutes les branches
    trufflehog git https://github.com/target/repo --include-detectors=all

    # Scanner une branche spécifique
    trufflehog git https://github.com/target/repo --branch main

    # Scanner depuis un commit spécifique
    trufflehog git https://github.com/target/repo --since-commit abc123

## Scan d’organisation GitHub

    # Scanner tous les dépôts publics d'une organisation
    trufflehog github --org=TargetCorp --token=ghp_token

    # Inclure les dépôts privés (nécessite les permissions de token appropriées)
    trufflehog github --org=TargetCorp --token=ghp_token --include-repos=private

    # Exclure des dépôts spécifiques
    trufflehog github --org=TargetCorp --token=ghp_token \
      --exclude-repos=archived-repo,test-repo

## Sortie et filtrage

    # Sortie JSON
    trufflehog git https://github.com/target/repo --json

    # N'afficher que les findings de détecteurs spécifiques
    trufflehog git url --only-verified --include-detectors=AWS,GitHub,Slack

    # Exclure des détecteurs spécifiques
    trufflehog git url --exclude-detectors=generic

    # Sauvegarder la sortie
    trufflehog git url --json 2>&1 | tee findings.json

## Ce que TruffleHog détecte

Catégories de détecteurs courantes :

- AWS : clés d’accès, clés secrètes, tokens de session
- GitHub/GitLab : tokens d’accès personnel, tokens OAuth
- Google : clés API, credentials de compte de service
- Slack : tokens API, webhooks
- Stripe : clés API (live et test)
- Twilio : tokens d’authentification
- SendGrid : clés API
- Generic : chaînes à haute entropie, clés privées (PEM/PGP)

## Intégration CI/CD

    # GitHub Actions
    - name: TruffleHog Scan
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        base: ${{ github.event.repository.default_branch }}
        head: HEAD
        extra_args: --only-verified

    # Hook pre-commit
    cat > .git/hooks/pre-commit << 'EOF'
    #!/bin/bash
    trufflehog git file://. --since-commit HEAD --only-verified --fail
    EOF
    chmod +x .git/hooks/pre-commit

## Conseils

- `--only-verified` réduit considérablement les faux positifs en testant réellement les credentials
- Toujours scanner l’historique git : les secrets sont souvent supprimés du code actuel mais restent dans l’historique
- Le flag `--json` est essentiel pour le traitement programmatique des résultats
- Lancer contre des organisations GitHub pendant l’OSINT : les développeurs commettent souvent accidentellement des secrets

Aide / Page de manuel

    trufflehog <source> [options]

    Sources:
      git URL            Git repository
      github             GitHub repos/orgs
      gitlab             GitLab repos
      filesystem PATH    Local directory
      s3                 AWS S3 bucket
      gcs                Google Cloud Storage
      docker             Docker image
      circleci           CircleCI
      travisci           Travis CI

    Common options:
      --only-verified    Only report verified/valid secrets
      --no-verification  Skip credential verification
      --include-detectors  Comma-separated detector list
      --exclude-detectors  Detectors to skip
      --json             JSON output
      --since-commit HASH  Scan from specific commit
      --branch BRANCH    Specific branch
      --token TOKEN      Auth token for private repos
      --fail             Exit with error code if secrets found