Under Construction
Back to Blog
Tool••15 min•141 views••

Trufflehog

Minh Khoa

Minh Khoa

Author

TruffleHog: Tool for detecting and handling exposed "Secrets"

TruffleHog is a powerful open-source tool designed to detect and handle exposed "secrets" (secret) exposed API keys, database passwords, private keys, tokens,...

Overview

  • Detection scope (Discovery): TruffleHog can search for passwords across many different sources such as Git (including commit history), filesystem, Docker container, S3, CI logs, chat, wiki,...
  • Classification (Classification): supports more than 800 types of secret identifiers — from AWS, Stripe, Cloudflare to keys SSL, Postgres passwords... helping quickly identify the type of secret that was leaked.
  • Verification (Validation): TruffleHog also automatically tries to log in with the detected secret to verify its validity, thereby identifying what is a real threat.
  • Further analysis (Analysis): For common secret types, the tool will query API to collect additional information such as who created it, what it is allowed to access, what its permissions are… helping assess risk more accurately.

Scan Repo in Git

Scan the entire commit history to show the warnings and errors to pay attention to.

Mac & Window:

git clone [https://github.com/trufflesecurity/trufflehog.git](https://github.com/trufflesecurity/trufflehog.git)
cd trufflehog
go install

Scan S3 in AWS

"S3 is just a place to store files, so why scan it?"Because developers often accidentally push sensitive files to S3 such as:

  • 🔐 API key, token, password: .env, config.json, .pem, .p12, .aws/credentials
  • 📄 Sensitive internal documents: client-list.xlsx, payment_config.pdf, user_dump.sql
  • ⚙️ Configuration files containing secrets: config.js, firebase-config.json, settings.py
  • 🔑 Private key / SSH key / JWT secret: id_rsa, jwt-secret.txt
  • 💾 Database dumps or log files: user_data.json, prod.log contain user information, email

Basic command:

trufflehog s3 --bucket=<bucket-name> --results=verified,unknown

Detail:

trufflehog s3 \
--bucket=my-private-bucket \
--aws-access-key-id=YOUR_ACCESS_KEY \
--aws-secret-access-key=YOUR_SECRET_KEY \
--region=ap-southeast-1 \
--results=verified,unknown \
--json > s3_secrets.json

Results when TruffleHog scanning secrets in the repo

✅ 1. No real key exposed (not yet verified, Verified: false)

Usually these are suspicious strings that look like key/API token/password but are not certain. There are fields such as:

"Verified": false,
"VerificationError": "i/o timeout" hoặc null,
"Raw": "[http://user:pass@example.com](http://user:pass@example.com)",
"Redacted": "http://user:********@example.com"

These are not necessarily leaked, for example:

  • Sample code
  • File test
  • Default config
  • Or located in node_modules/, README.md, url.test.js...

🟡 → You need to manually check each line to see whether it is dummy/test or a real key that was pushed.

❌ 2. Real key exposed (Verified: true)

When Verified: true → TruffleHog the key has been successfully verified by calling API or by checking the actual pattern.

For example, the result will be:

"Verified": true,
"Raw": "ghp_xxxxxxx",
"Redacted": "ghp_*******"

In ExtraData there will sometimes be revoke instructions:

"rotation_guide": "[https://howtorotate.com/docs/tutorials/github/](https://howtorotate.com/docs/tutorials/github/)"

🟥 → Extremely dangerous! Must do immediately:

  • Revoke key / credential
  • Remove from Git history
  • Regenerate & rotate