Rusty Hog é um scanner de segredos construído em Rust para desempenho, e baseado no TruffleHog que é escrito em Python. O Rusty Hog fornece os seguintes binários:

Ankamali Hog: Escaneia segredos em um documento do Google.
Berkshire Hog: Escaneia segredos em um bucket S3.
Choctaw Hog: Escaneia segredos em um repositório Git.
Duroc Hog: Escaneia segredos em um diretório, arquivo e archive.
Essex Hog: Escaneia segredos em uma página wiki do Confluence.
Gottingen Hog: Escaneia segredos em um issue do JIRA.
Slack Hog: Escaneia segredos em um Canal do Slack.

Tabela de conteúdos

Em seguida, execute `./build_lambda_macos.sh`. O script de compilação será compilado contra o OpenSSL 3.0.12. Use `export OPENSSL_BUILD_VER=3.0.12` para substituir. O script de compilação será compilado contra os cabeçalhos do kernel Amazon Linux fornecidos pelo RPM deles; `export AMAZON_KERNEL_HEADERS_RPM_URL=...` para substituir de onde o RPM é baixado. (Não há nada que impeça o uso do RPM de linux-headers de uma distribuição diferente, só precisamos dos linux-headers para compilar openssl para Linux) O script de compilação criará um diretório build-deps na raiz do seu código-fonte atual. Você pode `rm -rf` este diretório com segurança, mas ele será recriado na próxima execução do script de compilação. Ele também fará várias verificações de consistência para garantir que a compilação funcione e, se essas falharem, poderá solicitar que você `rm -rf` esse diretório de qualquer forma para tentar novamente. ### Linux Certifique-se de que `cross` está instalado (`cargo install cross`), então apenas execute `./build_lambda.sh`. # Commands ## Uso do Anakamali Hog (GDoc Scanner)``` USAGE: ankamali_hog [FLAGS] [OPTIONS] <GDRIVEID> FLAGS: --caseinsensitive Sets the case insensitive flag for all regexes --entropy Enables entropy scanning --oauthsecret Path to an OAuth secret file (JSON) ./clientsecret.json by default --oauthtoken Path to an OAuth token storage file ./temp_token by default --prettyprint Outputs the JSON in human readable format -v, --verbose Sets the level of debugging information -h, --help Prints help information -V, --version Prints version information OPTIONS: -a, --allowlist <ALLOWLIST> Sets a custom allowlist JSON file --default_entropy_threshold <DEFAULT_ENTROPY_THRESHOLD> Default entropy threshold (0.6 by default) -o, --outputfile <OUTPUT> Sets the path to write the scanner results to (stdout by default) --regex <REGEX> Sets a custom regex JSON file ARGS: <GDRIVEID> The ID of the Google drive file you want to scan

## Uso do Berkshire Hog (Scanners S3 - Lambda) O Berkshire Hog atualmente é projetado para ser usado como uma função Lambda. Este é o fluxo básico de dados: <pre> ┌───────────┐ ┌───────┐ ┌────────────────┐ ┌────────────┐ │ S3 bucket │ ┌────────┐ │ │ │ Berkshire Hog │ │ S3 bucket │ │ (input) ─┼─┤S3 event├──▶│ SQS │────▶│ (Lambda) │────▶│ (output) │ │ │ └────────┘ │ │ │ │ │ │ └───────────┘ └───────┘ └────────────────┘ └────────────┘ </pre> Para executar o Berkshire Hog desta forma, configure o seguinte: 1) Configure o bucket de entrada para enviar um "evento" ao SQS para cada evento PUSH/PUT. 2) Configure o tópico SQS para aceitar eventos do S3, incluindo permissões IAM. 3) Execute o Berkshire Hog com acesso IAM ao SQS e S3. ## Uso do Choctaw Hog (Scanner Git)``` USAGE: choctaw_hog [FLAGS] [OPTIONS] <GITPATH> FLAGS: --caseinsensitive Sets the case insensitive flag for all regexes --entropy Enables entropy scanning --prettyprint Outputs the JSON in human readable format -v, --verbose Sets the level of debugging information -h, --help Prints help information -V, --version Prints version information OPTIONS: --default_entropy_threshold <DEFAULT_ENTROPY_THRESHOLD> Default entropy threshold (4.5 by default) --httpspass <HTTPSPASS> Takes a password for HTTPS-based authentication --httpsuser <HTTPSUSER> Takes a username for HTTPS-based authentication -o, --outputfile <OUTPUT> Sets the path to write the scanner results to (stdout by default) --recent_days <RECENTDAYS> Filters commits to the last number of days (branch agnostic) -r, --regex <REGEX> Sets a custom regex JSON file --since_commit <SINCECOMMIT> Filters commits based on date committed (branch agnostic) --sshkeypath <SSHKEYPATH> Takes a path to a private SSH key for git authentication, defaults to ssh-agent --sshkeyphrase <SSHKEYPHRASE> Takes a passphrase to a private SSH key for git authentication, defaults to none --until_commit <UNTILCOMMIT> Filters commits based on date committed (branch agnostic) -a, --allowlist <ALLOWLIST> Sets a custom ALLOWLIST JSON file ARGS: <GITPATH> Sets the path (or URL) of the Git repo to scan. SSH links must include username (git@)

A partir da versão 1.0.11, o JSON regex padrão atual usado é o seguinte:```json { "Slack Token": "(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})", "RSA private key": "-----BEGIN RSA PRIVATE KEY-----", "SSH (DSA) private key": "-----BEGIN DSA PRIVATE KEY-----", "SSH (EC) private key": "-----BEGIN EC PRIVATE KEY-----", "PGP private key block": "-----BEGIN PGP PRIVATE KEY BLOCK-----", "Amazon AWS Access Key ID": "AKIA[0-9A-Z]{16}", "Amazon MWS Auth Token": "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", "Facebook Access Token": "EAACEdEose0cBA[0-9A-Za-z]+", "Facebook OAuth": "(?i)facebook[\\s[[:punct:]]]{1,4}[0-9a-f]{32}[\\s[[:punct:]]]?", "GitHub": "(?i)(github|access[[:punct:]]token)[\\s[[:punct:]]]{1,4}[0-9a-zA-Z]{35,40}", "Generic API Key": { "pattern": "(?i)(api|access)[\\s[[:punct:]]]?key[\\s[[:punct:]]]{1,4}[0-9a-zA-Z\\-_]{16,64}[\\s[[:punct:]]]?", "entropy_filter": true, "threshold": "0.6", "keyspace": "guess" }, "Generic Account API Key": { "pattern": "(?i)account[\\s[[:punct:]]]?api[\\s[[:punct:]]]{1,4}[0-9a-zA-Z\\-_]{16,64}[\\s[[:punct:]]]?", "entropy_filter": true, "threshold": "0.6", "keyspace": "guess" }, "Generic Secret": { "pattern": "(?i)secret[\\s[[:punct:]]]{1,4}[0-9a-zA-Z-_]{16,64}[\\s[[:punct:]]]?", "entropy_filter": true, "threshold": "0.6", "keyspace": "guess" }, "Google API Key": "AIza[0-9A-Za-z\\-_]{35}", "Google Cloud Platform API Key": "AIza[0-9A-Za-z\\-_]{35}", "Google Cloud Platform OAuth": "(?i)[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com", "Google Drive API Key": "AIza[0-9A-Za-z\\-_]{35}", "Google Drive OAuth": "(?i)[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com", "Google (GCP) Service-account": "(?i)\"type\": \"service_account\"", "Google Gmail API Key": "AIza[0-9A-Za-z\\-_]{35}", "Google Gmail OAuth": "(?i)[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com", "Google OAuth Access Token": "ya29\\.[0-9A-Za-z\\-_]+", "Google YouTube API Key": "AIza[0-9A-Za-z\\-_]{35}", "Google YouTube OAuth": "(?i)[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com", "Heroku API Key": "[h|H][e|E][r|R][o|O][k|K][u|U][\\s[[:punct:]]]{1,4}[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}", "MailChimp API Key": "[0-9a-f]{32}-us[0-9]{1,2}", "Mailgun API Key": "(?i)key-[0-9a-zA-Z]{32}", "Credentials in absolute URL": "(?i)((https?|ftp)://)(([a-z0-9$_\\.\\+!\\*'\$\$,;\\?&=-]|%[0-9a-f]{2})+(:([a-z0-9$_\\.\\+!\\*'\$\$,;\\?&=-]|%[0-9a-f]{2})+)@)((([a-z0-9]\\.|[a-z0-9][a-z0-9-]*[a-z0-9]\\.)*[a-z][a-z0-9-]*[a-z0-9]|((\\d|[1-9]\\d|1\\d{2}|2[0-4][0-9]|25[0-5])\\.){3}(\\d|[1-9]\\d|1\\d{2}|2[0-4][0-9]|25[0-5]))(:\\d+)?)(((/+([a-z0-9$_\\.\\+!\\*'\$\$,;:@&=-]|%[0-9a-f]{2})*)*(\\?([a-z0-9$_\\.\\+!\\*'\$\$,;:@&=-]|%[0-9a-f]{2})*)?)?)?", "PayPal Braintree Access Token": "(?i)access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}", "Picatic API Key": "(?i)sk_live_[0-9a-z]{32}", "Slack Webhook": "(?i)https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}", "Stripe API Key": "(?i)sk_live_[0-9a-zA-Z]{24}", "Stripe Restricted API Key": "(?i)rk_live_[0-9a-zA-Z]{24}", "Square Access Token": "(?i)sq0atp-[0-9A-Za-z\\-_]{22}", "Square OAuth Secret": "(?i)sq0csp-[0-9A-Za-z\\-_]{43}", "Twilio API Key": "SK[0-9a-fA-F]{32}", "Twitter Access Token": "(?i)twitter[\\s[[:punct:]]]{1,4}[1-9][0-9]+-[0-9a-zA-Z]{40}", "Twitter OAuth": "(?i)twitter[\\s[[:punct:]]]{1,4}['|\"]?[0-9a-zA-Z]{35,44}['|\"]?", "New Relic Partner & REST API Key": "[\\s[[:punct:]]][A-Fa-f0-9]{47}[\\s[[:punct:]][[:cntrl:]]]", "New Relic Mobile Application Token": "[\\s[[:punct:]]][A-Fa-f0-9]{42}[\\s[[:punct:]][[:cntrl:]]]", "New Relic Synthetics Private Location": "(?i)minion_private_location_key", "New Relic Insights Key (specific)": "(?i)insights[\\s[[:punct:]]]?(key|query|insert)[\\s[[:punct:]]]{1,4}\\b[\\w-]{32,40}\\b", "New Relic Insights Key (vague)": "(?i)(query|insert)[\\s[[:punct:]]]?key[\\s[[:punct:]]]{1,4}b[\\w-]{32,40}\\b", "New Relic License Key": "(?i)license[\\s[[:punct:]]]?key[\\s[[:punct:]]]{1,4}\\b[\\w-]{32,40}\\b", "New Relic Internal API Key": "(?i)nr-internal-api-key", "New Relic HTTP Auth Headers and API Key": "(?i)(x|newrelic|nr)-?(admin|partner|account|query|insert|api|license)-?(id|key)[\\s[[:punct:]]]{1,4}\\b[\\w-]{32,47}\\b", "New Relic API Key Service Key (new format)": "(?i)NRAK-[A-Z0-9]{27}", "New Relic APM License Key (new format)": "(?i)[a-f0-9]{36}NRAL", "New Relic APM License Key (new format, region-aware)": "(?i)[a-z]{2}[0-9]{2}xx[a-f0-9]{30}NRAL", "New Relic REST API Key (new format)": "(?i)NRRA-[a-f0-9]{42}", "New Relic Admin API Key (new format)": "(?i)NRAA-[a-f0-9]{27}", "New Relic Insights Insert Key (new format)": "(?i)NRII-[A-Za-z0-9-_]{32}", "New Relic Insights Query Key (new format)": "(?i)NRIQ-[A-Za-z0-9-_]{32}", "New Relic Synthetics Private Location Key (new format)": "(?i)NRSP-[a-z]{2}[0-9]{2}[a-f0-9]{31}", "Email address": "(?i)\\b(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*)@[a-z0-9][a-z0-9-]+\\.(com|de|cn|net|uk|org|info|nl|eu|ru)([\\W&&[^:/]]|\\A|\\z)", "New Relic Account IDs in URL": "(newrelic\\.com/)?accounts/\\d{1,10}/", "Account ID": "(?i)account[\\s[[:punct:]]]?id[\\s[[:punct:]]]{1,4}\\b[\\d]{1,10}\\b", "Salary Information": "(?i)(salary|commission|compensation|pay)([\\s[[:punct:]]](amount|target))?[\\s[[:punct:]]]{1,4}\\d+" }

Esteja ciente de que estas são strings, não expressões regex, e as chaves para esta lista de permissões devem ser uma chave no JSON de regex. As chaves diferenciam maiúsculas de minúsculas. # Project information ## Open source license This project is distributed under the [Apache 2 license](https://github.com/newrelic/rusty-hog/blob/HEAD/LICENSE). ## Support New Relic has open-sourced this project. This project is provided AS-IS WITHOUT WARRANTY OR SUPPORT, although you can report issues and contribute to the project here on GitHub. _Please do not report issues with this software to New Relic Global Technical Support._ ## Community New Relic hosts and moderates an online forum where customers can interact with New Relic employees as well as other customers to get help and share best practices. Like all official New Relic open source projects, there's a related Community topic in the New Relic Explorer's Hub. You can find this project's topic/threads here: https://discuss.newrelic.com/t/rusty-hog-multi-platform-secret-key-scanner/90117 ## Issues / enhancement requests Submit issues and enhancement requests in the [Issues tab of this repository](https://raw.githubusercontent.com/newrelic/issues). Please search for and review the existing open issues before submitting a new issue. ## Contributing Contributions are welcome (and if you submit a enhancement request, expect to be invited to contribute it yourself). Please review our [Contributors Guide](https://github.com/newrelic/rusty-hog/blob/HEAD/CONTRIBUTING.md). Keep in mind that when you submit your pull request, you'll need to sign the CLA via the click-through using CLA-Assistant. If you'd like to execute our corporate CLA, or if you have any questions, please drop us an email at [email protected]. ## Feature Roadmap - 1.1: Enterprise features - [ ] Support config files (instead of command line args) - [ ] Support environment variables instead of CLI args - [ ] Multi-threading - [ ] Better context detection and false positive filtering (GitHound, machine learning) - [ ] Use Rusoto instead of s3-rust - [x] Add JIRA scanner - [x] Add file-system & archive scanner - [ ] Use Rust features to reduce compilation dependencies? - 1.2: Integration with larger scripts and UIs - [ ] Support Github API for larger org management - [ ] Scan all repos for a list of users - [x] Scan all repos in an org - [ ] Generate a web report or web interface. Support "save state" generation from UI. - [ ] Agent/manager model - [ ] Scheduler process (blocked by save state support) ## What does the name mean? TruffleHog is considered the de facto standard / original secret scanner. I have been building a suite of secret scanning tools for various platforms based on TruffleHog and needed a naming scheme, so I started at the top of Wikipedia's [list of pig breeds](https://en.wikipedia.org/wiki/List_of_pig_breeds). Thus each tool name is a breed of pig starting at "A" and working up.

rusty-hog

Mais Populares

Uso

Como instalar usando binários baixados

Como construir

Como compilar o Berkshire Hog para Lambda

macOS

Berkshire Hog (S3 Scanner - CLI) uso```

Duroc Hog (scanner de sistema de ficheiros) uso```

Gottingen Hog (scanner JIRA) uso```

Formato do arquivo JSON de regex

Formato do arquivo JSON de lista de permissões