4 ms·
TruffleHog – Searches through Git repositories for high entropy strings
- empath75 10y agoThis is really clever. I run a stash server. Is there a way to get this to run on all the repos?
- nickthemagicman 10y agoHate to be dumb, but what exactly is a 'high entropy string'? Thanks in advance. EDIT: I see now. http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/ http://blogs.splunk.com/2015/10/01/random-words-on-entropy-a... So you're looking for hashes gotcha.
- daveguy 10y agoA string that is close to random noise. Low repetition. Like what you would find in a randomly generated cryptographic key.
- smoyer 10y agoMy security officer is going to love this!
- infogulch 10y agoI wonder what the false positive rate is on perl.
- MildlySerious 10y agoIf you read the description of how it works, it says it only searches for base64 and hex blobs, so I doubt it would be any higher than for any other code.
- codelion 10y agoInteresting project, you can also search for all kinds of suspicious commits using commit watcher: https://github.com/srcclr/commit-watcher https://github.com/srcclr/commit-watcher
- bpchaps 10y agoI tried something similar to this a while back and found that using Shannon entropy, though effective with long strings, failed pretty hard with shorter strings. Lots and lots of false positives. An alternative that worked surprisingly well (though, not without flaws) was to use a password strength checker similar to python's passwordmeter library. POC: https://github.com/red-bin/password_finder https://github.com/red-bin/password_finder
- ryan_lane 10y agoIf you're looking for something higher signal and lower noise, see: https://github.com/lyft/bandit-high-entropy-string https://github.com/lyft/bandit-high-entropy-string Note that bandit is for python, so it'll only match against potential secrets hardcoded into python code, but it takes the AST in mind, so the signal is way higher.