![]() TruffleHog's search capabilities make it "effective at finding secrets accidentally committed that contain high entropy," Ayrey says, and the tool needs nothing more than GitPython to work.Īyrey commented: "This module will go through the entire commit history of each branch, and check each diff from each commit, and evaluate the Shannon entropy for both the base64 character set and hexidecimal character set for every blob of text greater than 20 characters comprised of those character sets in each diff." The tool, dubbed TruffleHog, is able to search for and locate keys containing high-entropy strings by digging deep into commit history and branches, according to developer Dylan Ayrey. 41 impressive questions to ask in a job interviewĪ researcher has published a tool for finding secret keys with varying cryptographic strength in git repositories.
0 Comments
Leave a Reply. |