TruffleHog Secret Scanning

TruffleHog Secret Scanning

RedAmon includes a TruffleHog secret scanning module that searches GitHub repositories for exposed secrets, API keys, and credentials using 700+ secret detectors with optional verification against live APIs. It runs as an independent module (separate from the recon pipeline), triggered from the Other Scans modal in the Red Zone toolbar.

---

What It Detects

TruffleHog uses 700+ built-in secret detectors covering:

• AWS access keys, secret keys, and session tokens
• Google Cloud credentials, service accounts, and OAuth tokens
• Azure credentials and connection strings
• Database connection strings (MongoDB, PostgreSQL, MySQL, Redis)
• JWT tokens and session secrets
• Private RSA/SSH/PGP keys
• Slack, Discord, Stripe, Twilio, SendGrid, Mailgun tokens
• GitHub, GitLab, Bitbucket tokens
• Generic API keys and high-entropy strings
• And hundreds more credential patterns

Verification

Unlike regex-only scanners, TruffleHog can verify each finding by testing it against the live API (e.g., calling the AWS STS API with a found key). Verified findings are confirmed active credentials — a critical severity distinction.

Mode	Description
Default	Detects secrets and attempts verification where supported
Only Verified	Only reports findings that were confirmed active against live APIs
No Verification	Skips all API verification — faster but no confirmation of active credentials

---

Step 1: Configure a GitHub Personal Access Token

TruffleHog uses the same GitHub Access Token configured in Global Settings that is shared with the GitHub Secret Hunt module. If you have already set up a token for GitHub Secret Hunting, no additional configuration is needed.

If you haven't yet:

1. Go to GitHub.com and click your profile picture (top-right) then Settings
2. In the left sidebar, scroll down and click Developer settings
3. Click Personal access tokens then Tokens (classic)
4. Click Generate new token then Generate new token (classic)
5. Give it a descriptive name (e.g., redamon-secret-scan)
6. Set an expiration (recommended: 30 or 90 days)
7. Select these scopes:

Scope	Required?	Purpose
repo	Yes	Full access to public and private repositories. Without this scope, only public repos are scanned.
read:org	If scanning orgs	List organization repositories

Private repos: The repo scope grants access to all private repositories the token owner can see. To scan only specific private repos, use a fine-grained personal access token and grant access to individual repositories — this is the most secure option.

8. Click Generate token and copy the token immediately (starts with ghp_). You won't see it again.
9. Paste the token into Global Settings > API Keys > GitHub Access Token

---

Step 2: Configure TruffleHog Settings

1. Go to your project settings (Projects page > click project card)
2. Navigate to the Integrations tab (Tab 11)
3. Enter your TruffleHog settings:

Field	Default	Description
Target Organization	—	The GitHub org name or username to scan (e.g., example-inc or johndoe)
Target Repositories	(all)	Comma-separated repo names to limit scope (e.g., webapp, api-server). Leave empty to scan all
Only Verified	false	Only report findings verified as active against live APIs
No Verification	false	Skip all API verification — faster scans but no confirmation
Concurrency	8	Number of concurrent scanning workers
Include Detectors	(all)	Comma-separated detector names to include (e.g., aws, github). Leave empty for all 700+
Exclude Detectors	(none)	Comma-separated detector names to exclude

4. Click Save

---

Step 3: Run the TruffleHog Scan

1. On the Red Zone, locate the Other Scans button (blue, GitHub icon) in the toolbar
2. Click the "Other Scans" button to open the modal
3. In the modal, find the TruffleHog Secret Scanner section
4. Click the Start button to launch the scan
5. Click the Logs button to watch real-time progress
6. When complete, click the Download button to save results as JSON

The modal also contains the GitHub Secret Hunt scanner — both can be managed independently from the same modal.

---

Understanding Results

TruffleHog findings are stored in the Neo4j graph with the following hierarchy:

Domain ──HAS_TRUFFLEHOG_SCAN──> TrufflehogScan
TrufflehogScan ──HAS_REPOSITORY──> TrufflehogRepository
TrufflehogRepository ──HAS_FINDING──> TrufflehogFinding

Each TrufflehogFinding node includes:

Property	Description
detector_name	The detector that matched (e.g., AWS, GitHub, Slack)
verified	Whether the credential was confirmed active via API verification
redacted	The redacted version of the secret
repository	The repository where the secret was found
file	The file path within the repository
commit	The commit SHA where the secret appears
line	The line number in the file
link	A direct link to the finding on GitHub

Findings are deduplicated by repository + file + line + detector_name.

The AI agent can access these findings through graph queries and incorporate them into its attack analysis.

---

Configuration Reference

Parameter	Default	Description
Target Organization	—	GitHub org or username to scan
Target Repositories	(all)	Comma-separated repo names to limit scope
Only Verified	false	Only report verified (confirmed active) findings
No Verification	false	Skip API verification entirely
Concurrency	8	Concurrent scanning workers (1-20)
Include Detectors	(all)	Comma-separated detector names to include
Exclude Detectors	(none)	Comma-separated detector names to exclude

Note: The GitHub Access Token is configured in Global Settings > API Keys, not in project settings. It is shared with the GitHub Secret Hunt module.

---

Next Steps

• GitHub Secret Hunting — the complementary regex-based secret scanner
• AI Agent Guide — use the AI agent to analyze all findings including leaked secrets