shhgit - find secrets and sensitive files across GitHub (including Gists), GitLab and BitBucket

Love shhgit? Help me reach my goal by sponsoring me via GitHub: https://github.com/sponsors/eth0izzle/

NEW: LIVE VERSION. Find secrets find from your browser!

Finding secrets in GitHub is nothing new. There are many great tools available to help with this depending on which side of the fence you sit. On the adversarial side, popular tools such as gitrob and truggleHog focus on digging in to commit history to find secret tokens from specific repositories, users or organisations. On the defensive side, GitHub themselves are actively scanning for secrets through their token scanning project. Their objective is to identify secret tokens within committed code in real-time and notify the service provider to action. So in theory, if any AWS secret keys are committed to GitHub, Amazon will be notified and automatically revoke them.

I developed shhgit to raise awareness and bring to life the prevalence of this issue. I hope GitHub will do more to prevent bad actors using the treasure trove of information across the platform. I don't know the inner-workings of their token scanning project but delaying the real-time feed API until the pipeline has completed and posing SLAs on the providers seems like a step in the right direction.

Read the rest of this story with a free account.

Login Login with facebook

Login Login with google

Sign up with Google Sign up with Facebook Sign up with email

Already have an account? Sign in

Author

Hiep Nguyen

• BlogSeptember 23, 2023Leveraging AI in Cybersecurity: Transforming Threat Detection, Prevention, and Beyond
• BlogAugust 24, 2023How Simply Browsing The Internet Gives Scammers An Advantage – And What You Can Do About It
• BlogJuly 1, 2022WEF - WiFi Exploitation Framework
• BlogMay 19, 2022Osmedeus is a Workflow Engine for Offensive Security