意外泄露机密——用户名和密码、API 令牌或私钥——到公共代码仓库中，是开发者和安全团队最可怕的噩梦。欺诈者不断扫描公共代码仓库以寻找这些秘密，从而获得系统立足点。代码比以往任何时候都更互联，因此这些秘密常常提供对私密和敏感数据的访问——例如云基础设施、数据库服务器、支付网关和文件存储系统等。
shhgit 可以持续扫描你的代码仓库，发现并提醒你这些秘密。
你有两个选择。我推荐第一个，因为它可以让你访问 shhgit 实时 Web 界面。如果你只想要命令行界面，请使用第二个选项。
git clone https://github.com/eth0izzle/shhgit.gitdocker-compose buildconfig.yaml 文件（例如添加你的 GitHub 令牌）docker-compose up注意：此方法不包括 shhgit Web 界面
go get github.com/eth0izzle/shhgit 会自动下载并构建 shhgit。或者你可以克隆此仓库并运行 go build -v -i。config.yaml 文件，然后查看下面的用法。shhgit 可以通过两种方式工作：使用 GitHub、Gist、GitLab 和 BitBucket 的公共 API，或者处理本地目录中的文件。
默认情况下，shhgit 将以前者“公共模式”运行。对于 GitHub 和 Gist，你需要获取并提供访问令牌（参见此指南；它不需要任何范围或权限）。然后将其放在 config.yaml 的 github_access_tokens 下。GitLab 和 BitBucket 不需要任何 API 令牌。
你还可以放弃签名，使用自己的自定义搜索查询来运行 shhgit，例如，要查找所有 AWS 密钥，你可以使用 shhgit --search-query AWS_ACCESS_KEY_ID=AKIA。要以本地模式运行（并可能集成到你的 CI 流水线中），你可以传递 --local 标志（参见下面的用法）。
--clone-repository-timeout
Maximum time it should take to clone a repository in seconds (default 10)
--config-path
Searches for config.yaml from given directory. If not set, tries to find if from shhgit binary's and current directory
--csv-path
Specify a path if you want to write found secrets to a CSV. Leave blank to disable
--debug
Print debugging information
--entropy-threshold
Finds high entropy strings in files. Higher threshold = more secret secrets, lower threshold = more false positives. Set to 0 to disable entropy checks (default 5.0)
--local
Specify local directory (absolute path) which to scan. Scans only given directory recursively. No need to have Github tokens with local run.
--maximum-file-size
Maximum file size to process in KB (default 512)
--maximum-repository-size
Maximum repository size to download and process in KB) (default 5120)
--minimum-stars
Only clone repositories with this many stars or higher. Set to 0 to ignore star count (default 0)
--path-checks
Set to false to disable file name/path signature checking, i.e. just match regex patterns (default true)
--process-gists
Watch and process Gists in real time. Set to false to disable (default true)
--search-query
Specify a search string to ignore signatures and filter on files containing this string (regex compatible)
--silent
Suppress all output except for errors
--temp-directory
Directory to store repositories/matches (default "%temp%\shhgit")
--threads
Number of concurrent threads to use (default number of logical CPUs)
config.yaml 文件包含 7 个元素。提供了 默认配置。
github_access_tokens: # provide at least one token
- 'token one'
- 'token two'
webhook: '' # URL to a POST webhook.
webhook_payload: '' # Payload to POST to the webhook URL
blacklisted_strings: [] # list of strings to ignore
blacklisted_extensions: [] # list of extensions to ignore
blacklisted_paths: [] # list of paths to ignore
blacklisted_entropy_extensions: [] # additional extensions to ignore for entropy checks
signatures: # list of signatures to check
- part: '' # either filename, extension, path or contents
match: '' # simple text comparison (if no regex element)
regex: '' # regex pattern (if no match element)
name: '' # name of the signature
shhgit 自带 150 个签名。你可以通过编辑 config.yaml 文件来移除或添加更多签名。
1Password password manager database file, Amazon MWS Auth Token, Apache htpasswd file, Apple Keychain database file, Artifactory, AWS Access Key ID, AWS Access Key ID Value, AWS Account ID, AWS CLI credentials file, AWS cred file info, AWS Secret Access Key, AWS Session Token, Azure service configuration schema file, Carrierwave configuration file, Chef Knife configuration file, Chef private key, CodeClimate, Configuration file for auto-login process, Contains a private key, Contains a private key, cPanel backup ProFTPd credentials file, Day One journal file, DBeaver SQL database manager configuration file, DigitalOcean doctl command-line client configuration file, Django configuration file, Docker configuration file, Docker registry authentication file, Environment configuration file, esmtp configuration, Facebook access token, Facebook Client ID, Facebook Secret Key, FileZilla FTP configuration file, FileZilla FTP recent servers file, Firefox saved passwords DB, git-credential-store helper credentials file, Git configuration file, GitHub Hub command-line client configuration file, Github Key, GNOME Keyring database file, GnuCash database file, Google (GCM) Service account, Google Cloud API Key, Google OAuth Access Token, Google OAuth Key, Heroku API key, Heroku config file, Hexchat/XChat IRC client server list configuration file, High entropy string, HockeyApp, Irssi IRC client configuration file, Java keystore file, Jenkins publish over SSH plugin file, Jetbrains IDE Config, KDE Wallet Manager database file, KeePass password manager database file, Linkedin Client ID, LinkedIn Secret Key, Little Snitch firewall configuration file, Log file, MailChimp API Key, MailGun API Key, Microsoft BitLocker recovery key file, Microsoft BitLocker Trusted Platform Module password file, Microsoft SQL database file, Microsoft SQL server compact database file, Mongoid config file, Mutt e-mail client configuration file, MySQL client command history file, MySQL dump w/ bcrypt hashes, netrc with SMTP credentials, Network traffic capture file, NPM configuration file, NuGet API Key, OmniAuth configuration file, OpenVPN client configuration file, Outlook team, Password Safe database file, PayPal/Braintree Access Token, PHP configuration file, Picatic API key, Pidgin chat client account configuration file, Pidgin OTR private key, PostgreSQL client command history file, PostgreSQL password file, Potential cryptographic private key, Potential Jenkins credentials file, Potential jrnl journal file, Potential Linux passwd file, Potential Linux shadow file, Potential MediaWiki configuration file, Potential private key (.asc), Potential private key (.p21), Potential private key (.pem), Potential private key (.pfx), Potential private key (.pkcs12), Potential PuTTYgen private key, Potential Ruby On Rails database configuration file, Private SSH key (.dsa), Private SSH key (.ecdsa), Private SSH key (.ed25519), Private SSH key (.rsa), Public ssh key, Python bytecode file, Recon-ng web reconnaissance framework API key database, remote-sync for Atom, Remote Desktop connection file, Robomongo MongoDB manager configuration file, Rubygems credentials file, Ruby IRB console history file, Ruby on Rails master key, Ruby on Rails secrets, Ruby On Rails secret token configuration file, S3cmd configuration file, Salesforce credentials, Sauce Token, Sequel Pro MySQL database manager bookmark file, sftp-deployment for Atom, sftp-deployment for Atom, SFTP connection configuration file, Shell command alias configuration file, Shell command history file, Shell configuration file (.bashrc, .zshrc, .cshrc), Shell configuration file (.exports), Shell configuration file (.extra), Shell configuration file (.functions), Shell profile configuration file, Slack Token, Slack Webhook, SonarQube Docs API Key, SQL Data dump file, SQL dump file, SQLite3 database file, SQLite database file, Square Access Token, Square OAuth Secret, SSH configuration file, SSH Password, Stripe API key, T command-line Twitter client configuration file, Terraform variable config file, Tugboat DigitalOcean management tool configuration, Tunnelblick VPN configuration file, Twilo API Key, Twitter Client ID, Twitter Secret Key, Username and password in URI, Ventrilo server configuration file, vscode-sftp for VSCode, Windows BitLocker full volume encrypted data file, WP-Config
git checkout -b my-new-featuregit commit -am 'Add some feature'git push origin my-new-feature我对你如何使用此工具不承担任何责任。不要当混蛋。
MIT。参见 LICENSE