You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add generic JWT detection and verification (#4441)
This adds a generic detector and verifier for generic JWTs.
This uses regular expressions for detection. Only public key cryptography algorithms are supported. Additionally, OIDC Discovery is attempted against the issuer to fetch the public key for signature verification.
Bonus Cleanup:
* Fix mixed indentation in alchemy test
* Use `strings.ReplaceAll(...)` instead of `strings.Replace(..., -1)`
* Use integer range loop instead of explicit counting loop
* Revise and expand detectors.go comments
---------
Co-authored-by: Kashif Khan <70996046+kashifkhan0771@users.noreply.github.com>
Copy file name to clipboardExpand all lines: README.md
+8-4Lines changed: 8 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,19 +30,19 @@ To learn more about TruffleHog and its features and capabilities, visit our [pro
30
30
31
31
# :globe_with_meridians: TruffleHog Enterprise
32
32
33
-
Are you interested in continuously monitoring **Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint, and more..** for credentials? We have an enterprise product that can help! Learn more at <https://trufflesecurity.com/trufflehog-enterprise>.
33
+
Are you interested in continuously monitoring **Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint (and more)** for credentials? We have an enterprise product that can help! Learn more at <https://trufflesecurity.com/trufflehog-enterprise>.
34
34
35
35
We take the revenue from the enterprise product to fund more awesome open source projects that the whole community can benefit from.
36
36
37
37
</div>
38
38
39
39
# What is TruffleHog 🐽
40
40
41
-
TruffleHog is the most powerful secrets **Discovery, Classification, Validation,** and **Analysis** tool. In this context, secret refers to a credential a machine uses to authenticate itself to another machine. This includes API keys, database passwords, private encryption keys, and more...
41
+
TruffleHog is the most powerful secrets **Discovery, Classification, Validation,** and **Analysis** tool. In this context, secret refers to a credential a machine uses to authenticate itself to another machine. This includes API keys, database passwords, private encryption keys, and more.
42
42
43
43
## Discovery 🔍
44
44
45
-
TruffleHog can look for secrets in many places including Git, chats, wikis, logs, API testing platforms, object stores, filesystems and more
45
+
TruffleHog can look for secrets in many places including Git, chats, wikis, logs, API testing platforms, object stores, filesystems and more.
46
46
47
47
## Classification 📁
48
48
@@ -675,7 +675,7 @@ TruffleHog can be used in a pre-commit hook to prevent credentials from leaking
675
675
676
676
See the [pre-commit hook documentation](PreCommit.md) for more information.
677
677
678
-
## Regex Detector (alpha)
678
+
## Custom Regex Detector (alpha)
679
679
680
680
TruffleHog supports detection and verification of custom regular expressions.
681
681
For detection, at least one **regular expression** and **keyword** is required.
@@ -696,6 +696,10 @@ your custom detector has multiple `regex` set (in this example `hogID`, and `hog
696
696
### Regex Detector Example
697
697
[Here](/pkg/custom_detectors/CUSTOM_DETECTORS.md) is how to setup a custom regex detector with verification server.
698
698
699
+
## Generic JWT Detection
700
+
701
+
TruffleHog supports detection and verification of a subset of generic JWTs it finds.
702
+
Specifically, if a JWT uses public-key cryptography rather than HMAC and the public key can be obtained, TruffleHog can determine whether the JWT is live or not.
0 commit comments