Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance Trufflehog module to finds Deleted & Private Commits on GitHub #1642

Closed
domwhewell-sage opened this issue Aug 8, 2024 · 1 comment
Labels
enhancement New feature or request

Comments

@domwhewell-sage
Copy link
Contributor

Description
Trufflehog recently released a blog demonstrating that you could access deleted fork data on github https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github

They since released an update to the open-source trufflehog tool to discover hidden objects from these deleted forks. by scanning the original repo
https://trufflesecurity.com/blog/trufflehog-now-finds-all-deleted-and-private-commits-on-github

For this enhancement the trufflehog module would need to consume CODE_REPOSITORY events ensuring they are github code repositories and pass the repo url to trufflehog github-experimental --repo <url> --object-discovery

It would also need to be changed to access the github api token provided to the github template module

I will start working on this shortly

@domwhewell-sage domwhewell-sage added the enhancement New feature or request label Aug 8, 2024
domwhewell-sage added a commit to domwhewell-sage/bbot that referenced this issue Aug 9, 2024
@TheTechromancer
Copy link
Collaborator

Added in #1644.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants