Rusty Hog is a secret scanner built in Rust for performance, and based on TruffleHog which is written in Python. Rusty Hog provides the following binaries:

• Ankamali Hog: Scans for secrets in a Google doc.
• Berkshire Hog: Scans for secrets in an S3 bucket.
• Choctaw Hog: Scans for secrets in a Git repository.
• Duroc Hog: Scans for secrets in a directory, file, and archive.
• Essex Hog: Scans for secrets in a Confluence wiki page.
• Gottingen Hog: Scans for secrets in a JIRA issue.
• Slack Hog: Scans for secrets in a Slack Channel.

Table of contents

• Usage
  • How to install using downloaded binaries
  • How to run using DockerHub
  • How to build
  • How to build on Windows
  • Anakamali Hog (GDoc Scanner) usage
  • Berkshire Hog (S3 Scanner - CLI) usage
  • Berkshire Hog (S3 Scanner - Lambda) usage
  • Choctaw Hog (Git Scanner) usage
  • Duroc Hog (file system scanner) usage
  • Essex Hog (Confluence scanner) usage
  • Gottingen Hog (JIRA scanner) usage
  • Hante Hog (SLACK scanner) usage
  • Regex JSON file format
  • Allowlist JSON file format
• Project information
  • Open source license
  • Support
  • Community
  • Issues / enhancement requests
  • Contributing
  • Feature Roadmap
  • What does the name mean?

Usage

This project provides a set of scanners that use regular expressions to try and detect the presence of sensitive information, such as API keys, passwords, and personal information. It includes a set of regular expressions by default, but also accepts a JSON object containing your custom regular expressions.

How to install using downloaded binaries

Download and unzip the latest ZIP on the releases tab. Then, run each binary with -h to see the usage.

wget https://github.com/newrelic/rusty-hog/releases/download/v1.0.11/rustyhogs-darwin-choctaw_hog-1.0.11.zip
unzip rustyhogs-darwin-choctaw_hog-1.0.11.zip
darwin_releases/choctaw_hog -h

How to run using DockerHub

Rusty Hog Docker images can be found at the authors personal DockerHub page here A Docker Image is built for each Hog and for each release. So to use choctaw_hog you would run the following commands:

docker pull wetfeet2000/choctaw_hog:1.0.10
docker run -it --rm wetfeet2000/choctaw_hog:1.0.10 --help

How to build

• Ensure you have Rust installed and on your path.
• Clone this repo, and then run cargo build --release. The binaries are located in target/release.
• To build and view HTML documents, run cargo doc --no-deps --open.
• To run unit tests, run cargo test.
• To cross-compile Berkshire Hog for the AWS Lambda environment, run the following commands and upload berkshire_lambda.zip to your AWS Lambda dashboard:

docker run --rm -it -v "$(pwd)":/home/rust/src ekidd/rust-musl-builder cargo build --release
cp target/x86_64-unknown-linux-musl/release/berkshire_hog bootstrap
zip -j berkshire_lambda.zip bootstrap

How to build on Windows

You will need to compile static OpenSSL binaries and tell Rust/Cargo where to find them:

mkdir \Tools
cd \Tools
git clone https://github.com/Microsoft/vcpkg.git
cd vcpkg
.\bootstrap-vcpkg.bat
.\vcpkg.exe install openssl:x64-windows-static

$env:OPENSSL_DIR = 'C:\Tools\vcpkg\installed\x64-windows-static'
$env:OPENSSL_STATIC = 'Yes'
[System.Environment]::SetEnvironmentVariable('OPENSSL_DIR', $env:OPENSSL_DIR, [System.EnvironmentVariableTarget]::User)
[System.Environment]::SetEnvironmentVariable('OPENSSL_STATIC', $env:OPENSSL_STATIC, [System.EnvironmentVariableTarget]::User)

You can now follow the main build instructions listed above.

How to build Berkshire Hog for Lambda

macOS

Use Homebrew to get the dependencies:

brew install rpm2cpio FiloSottile/musl-cross/musl-cross

Then run ./build_lambda_macos.sh.

The build script will build against OpenSSL 3.0.12. Use export OPENSSL_BUILD_VER=3.0.12 to override.

The build script will build against Amazon Linux kernel headers provided by their RPM; export AMAZON_KERNEL_HEADERS_RPM_URL=... to override where the RPM is downloaded from. (There's nothing preventing a different distribution's linux-headers RPM from being used, we just need the linux-headers to build openssl for Linux)

The build script will create a build-deps directory in your current source root. You can rm -rf this directory safely, but it will be recreated on the next build script run. It will also do various consistency checks to make sure the build should work and if those fail, might ask you to rm -rf that directory anyway to try again.

Linux

Make sure cross is installed (cargo install cross), then just ./build_lambda.sh.

Commands

Anakamali Hog (GDoc Scanner) usage

USAGE:
    ankamali_hog [FLAGS] [OPTIONS] <GDRIVEID>

FLAGS:
        --caseinsensitive    Sets the case insensitive flag for all regexes
        --entropy            Enables entropy scanning
        --oauthsecret        Path to an OAuth secret file (JSON) ./clientsecret.json by default
        --oauthtoken         Path to an OAuth token storage file ./temp_token by default
        --prettyprint        Outputs the JSON in human readable format
    -v, --verbose            Sets the level of debugging information
    -h, --help               Prints help information
    -V, --version            Prints version information

OPTIONS:
    -a, --allowlist <ALLOWLIST>                                    Sets a custom allowlist JSON file
        --default_entropy_threshold <DEFAULT_ENTROPY_THRESHOLD>    Default entropy threshold (0.6 by default)
    -o, --outputfile <OUTPUT>                                      Sets the path to write the scanner results to (stdout by default)

        --regex <REGEX>                                            Sets a custom regex JSON file

ARGS:
    <GDRIVEID>    The ID of the Google drive file you want to scan

Berkshire Hog (S3 Scanner - CLI) usage

USAGE:
    berkshire_hog [FLAGS] [OPTIONS] <S3URI> <S3REGION>

FLAGS:
        --caseinsensitive    Sets the case insensitive flag for all regexes
        --entropy            Enables entropy scanning
        --prettyprint        Outputs the JSON in human readable format
    -r, --recursive          Recursively scans files under the prefix
    -v, --verbose            Sets the level of debugging information
    -h, --help               Prints help information
    -V, --version            Prints version information

OPTIONS:
    -a, --allowlist <ALLOWLIST>                                    Sets a custom allowlist JSON file
        --default_entropy_threshold <DEFAULT_ENTROPY_THRESHOLD>    Default entropy threshold (0.6 by default)
    -o, --outputfile <OUTPUT>                                      Sets the path to write the scanner results to (stdout by default)