Dustin Decker
14e44db2be
Move detectors.IsKnownFalsePositive from the detectors and into the engine ( #2643 )
...
* Remove detectors.IsKnownFalsePositive from detectors
* Centralize false positive removal in engine
* Don't apply fp filtering on custom regex to preserve previous behavior.
* fix empty branch
* update excludes
* update filtering
* Add result flag option and exclude some detectors
2024-04-22 15:18:04 -07:00
Ankush Goel
3fa86a1008
added onfleet api key detector ( #2375 )
...
* added onfleet detector
* use organization get endpoint
---------
Co-authored-by: Ahrav Dutta <ahrav.dutta@trufflesec.com>
2024-04-21 10:06:51 -07:00
Julien Doutre
32652a7498
Detect Slack workflows webhook ( #2569 )
2024-04-19 07:21:40 -07:00
Luska
e5575cd6f2
Adding Pagarme API key detection ( #2665 )
...
* Adding support to Pagarme API key detection
* adding scanner
---------
Co-authored-by: Ahrav Dutta <ahrav.dutta@trufflesec.com>
2024-04-10 17:57:25 -07:00
ahrav
867434331b
[refactor] - template detector ( #2692 )
...
* refactor template detector to only check for 200 status code
* Replace ldap.DialTLS w/ ldap.DialURL since the former is deprecated
* sort imports
2024-04-10 17:46:07 -07:00
fml09
c6b454e736
Remove unnecessary space in Vultr regex pattern ( #2689 )
...
* Fix incorrect regular expression with missing closing bracket
* Remove unnecessary space in Vultr regex pattern
2024-04-10 17:12:55 -07:00
Shreyas Sriram
08b6f90c81
Add Wiz detector ( #2691 )
...
* Implement wiz detector
* Fix tests
* Update false positive logic
2024-04-10 08:19:36 -07:00
Cody Rose
b745cfd495
Enrich Gitlab enumeration logging ( #2678 )
...
This PR modifies the GitLab source:
* emits a new "groups enumerated" metric
* logs more information about group enumeration
* emits the repo enumeration metric inside getAllProjectRepos, which means it will work when units are flipped on
* emits the repo enumeration metric more granularly
2024-04-08 10:47:05 -04:00
Cody Rose
14b1a6e236
Handle inactive Slack account tokens ( #2668 )
...
This PR updates the Slack detector to accommodate a previously unhandled error type. It also fixes the exiting Slack tests.
2024-04-05 10:26:20 -04:00
ahrav
3cb7aedf4a
[bug] - Add ASCII validation check for base64 decoding ( #2671 )
...
* Correclt handle invalid base64 with ascii check
* remove parallel
2024-04-04 16:59:13 -07:00
redismongo
f1957fec59
chore: fix some typos ( #2666 )
2024-04-04 05:50:47 -07:00
ahrav
a8132839f8
[chore] - update go-github dep manually ( #2664 )
...
* update go-github dep
* remove commented out line
2024-04-03 19:19:14 -07:00
ahrav
0fe39db56f
upgrade launchdarkly dep ( #2650 )
2024-04-03 07:24:20 -07:00
Richard Gomez
d0d59c2e77
chore: remove duplicate jiratoken.v2 detector ( #2657 )
2024-04-02 18:12:06 -07:00
kenzht
0d3023fe74
add GCP application default credentials detector ( #2530 )
...
* add GCP application default credentials detector
* add a comment
* update Keywords to better match the key
---------
Co-authored-by: Ahrav Dutta <ahrav.dutta@trufflesec.com>
2024-04-01 11:27:40 -07:00
Shreyas Sriram
31ad1eed30
Add JupiterOne detector ( #2446 )
...
* Add JupiterOne bootstrap
* Implement verification logic
* Cleanup
* Fix verificationError
* Undo unnecessary changes
---------
Co-authored-by: Ahrav Dutta <ahrav.dutta@trufflesec.com>
2024-03-29 19:14:04 -07:00
Richard Gomez
3b58a15a84
Fix GitHub enumeration & rate-limiting logic ( #2625 )
...
This is a follow-up to #2379 .
It fixes the following issues:
GitHub API calls missing rate-limit handling
The fix for Refactor GitHub source #2379 (comment) inadvertently resulting in duplicate API calls
2024-03-29 10:29:46 -04:00
dylanTruffle
7fccb52b16
Fixing nitro check ( #2631 )
...
* Fixing nitro check
* remove dupe detector and disable Alconst
---------
Co-authored-by: Dylan Ayrey <dylan@Dylans-MacBook-Pro.local>
Co-authored-by: Ahrav Dutta <ahrav.dutta@trufflesec.com>
Co-authored-by: ahrav <ahravdutta02@gmail.com>
2024-03-27 11:39:58 -07:00
Dustin Decker
612ff1a0f1
Use Lstat to identify non-regular files in filesystem source ( #2628 )
...
* Use Lstat to identify non-regular files in filesystem source
* fix test
2024-03-26 15:22:42 -07:00
ahrav
369d79080e
[bugfix] - Update the Anthropic detector ( #2629 )
...
* Update the Anthropic detector
* update comment
2024-03-26 15:01:32 -07:00
fml09
9da396e237
Fix incorrect regular expression with missing closing bracket ( #2616 )
2024-03-26 13:32:14 -05:00
ahrav
11afc3215b
[chore] - upgrade dep ( #2618 )
...
* upgrade dep
* remove dupe deps
2024-03-26 11:21:07 -07:00
Richard Gomez
95dc8d6e16
Fix additional GitHub test errors #2614
2024-03-26 09:34:12 -04:00
Richard Gomez
9d4cf87c02
fix(github): resolve panic & test failures ( #2608 )
2024-03-22 09:49:01 -07:00
Ankush Goel
6dbe80806b
Dockerhub v2 detector ( #2361 )
...
* Dockerhub v2 detector
* update package structure
---------
Co-authored-by: Dustin Decker <dustin@trufflesec.com>
2024-03-22 09:30:35 -07:00
Richard Gomez
441d9ff005
Update Snyk detector ( #2559 )
...
* feat(snyk): add extradata from api
* update test
---------
Co-authored-by: Dustin Decker <dustin@trufflesec.com>
2024-03-22 09:14:48 -07:00
faktas2
72fb2b9deb
MaxMind detector uses the right endpoint ( #2577 )
...
* MaxMind detector uses the right endpoint
The endpoint that the current detector uses fails in validating the license key as some license keys do not have permissions to the geoip API. This commit is to make the detector use the right endpoint https://dev.maxmind.com/license-key-validation-api
* Remove RawV2
* Remove trimspace and extra if branch
* Add the proper tests
* Use SetVerificationError
* Add SetVerificationError
* update tests
---------
Co-authored-by: Dustin Decker <dustin@trufflesec.com>
2024-03-22 09:10:44 -07:00
Richard Gomez
baf7ea1458
feat(gitparse): avoid uneeded calls to strconv.Unquote ( #2605 )
2024-03-22 08:35:10 -07:00
Richard Gomez
80e8a67c2d
Refactor GitHub source ( #2379 )
...
* refactor(github): cleanup logic
* fix(github): lookup wikis per-repo
* refactor(github): change scanErrs.String output
---------
Co-authored-by: Bill Rich <bill.rich@gmail.com>
2024-03-21 14:07:39 -07:00
Miccah
3a7266e540
[chore] Fix potential resource leak in postman source ( #2606 )
...
This moves workspace unpacking to a helper function to leverage a defer,
which ensures the file is always closed.
2024-03-21 10:21:13 -05:00
Zachary Rice
1216fa23c9
strings contain keyword check, add collection name to keywords ( #2602 )
2024-03-21 09:35:38 -05:00
Zachary Rice
b11ce72338
Postman Source ( #2579 )
...
postman source
Co-authored-by: Miccah <m.castorina93@gmail.com>
---------
Co-authored-by: Joe Leon <joe.leon@trufflesec.com>
Co-authored-by: Miccah Castorina <m.castorina93@gmail.com>
2024-03-20 11:36:20 -05:00
Richard Gomez
aa862e46bb
fix(git): decode unicode paths ( #2585 )
2024-03-19 08:50:27 -07:00
Miccah
931a28a537
[chore] Replace "Trufflehog" with "TruffleHog" ( #2584 )
2024-03-18 11:01:25 -07:00
Richard Gomez
fd7e7e6e29
fix(github): response can be nil ( #2583 )
2024-03-16 01:12:44 -07:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d
2ef7a4a49f
pull out verification logic from github detectors ( #2554 )
...
* pull out verification logic from github detectors
* deduplicate verify github logic
* pull out nil check
* return nil instead of empty struct
* skip gh old test bc we can't make new tokens
2024-03-15 15:00:45 -04:00
Richard Gomez
f5025fd382
Add --results flag ( #2372 )
...
This is a follow-up to #2107 and #2335 . It adds a new (hidden) --results flag that allows a user to show any combination of verified, unverified, and indeterminate secrets.
2024-03-15 10:19:31 -04:00
ahrav
800cc6d90b
[chore] - Record metrics before reset ( #2556 )
...
* Record buffer metrics before resetting.
* Address comment.
2024-03-12 09:35:18 -07:00
ahrav
b53054b605
Fix flaky test. ( #2564 )
2024-03-12 08:31:47 -07:00
ahrav
2e65773b27
use custom grow method ( #2555 )
2024-03-08 12:16:52 -08:00
joeleonjr
0bbb68931c
Canary verification ( #2531 )
...
* verify canaries against SNS; get ARN
* clean comments
* Update tests and logic
* added test for invalid canary secret
* added verify logic for canaries
* go mod tidy
---------
Co-authored-by: Dustin Decker <dustin@trufflesec.com>
2024-03-07 18:18:18 -08:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d
d7a33055ad
add version to extra data + moving existing versioned detectors into subdirectory format ( #2471 )
...
* moving existing versioned detectors into subdirectory format
* update docs for adding version number to extra data
* nits
2024-03-07 15:48:27 -05:00
Dustin Decker
dbf6965152
DB is not needed for ping command ( #2540 )
2024-03-06 17:08:37 -08:00
Cody Rose
b7f08db1ef
Redact secret in git command output ( #2539 )
...
When we fail to clone a git repository we log the command output to help with diagnosis. However, this output can include credentials in certain cases (such as certain errors associated with redirects). We don't want to log credentials when this happens.
2024-03-06 11:51:35 -05:00
Cody Rose
28ed81f0a2
Add naive S3 ignorelist ( #2536 )
...
This PR adds the ability to exclude buckets from S3 scans. The capability is pretty rudimentary right now, and does not support globbing. If both lists are specified the source to fail to initialize.
2024-03-05 08:01:20 -05:00
Richard Gomez
cbc0f0f48e
Create basic escaped unicode decoder ( #2456 )
...
* feat(decoders): basic escaped unicode
* wip: handle unicode notation
Experimenting with this.. might remove
2024-03-02 11:27:44 -08:00
ahrav
3da0c5e125
[feat] - Make the client configurable ( #2528 )
...
* Make the client configurable
* add comment
* add backoff option
2024-03-01 13:29:25 -08:00
Dylan Ayrey
7620906b07
Ignore canary IDs in notifications ( #2526 )
...
* Update aws.go
* Update aws.go
* Update tests
---------
Co-authored-by: Dustin Decker <dustin@trufflesec.com>
2024-02-28 16:52:50 -08:00
Dustin Decker
8ed0c0ad5d
Remove one filter word ( #2525 )
...
Removes a problematic word from the unverified filtering while we work on a more holistic fix.
2024-02-28 15:46:39 -08:00
trufflesteeeve
12ff21f245
Improve Gitlab default URL handling ( #2491 )
...
Co-authored-by: Miccah <m.castorina93@gmail.com>
2024-02-28 14:15:11 -05:00
