Welcome to this final demonstration using TruffleHog.
Here, you will learn how to perform a customized assessment.
This is a short demo, but a very important one, as you will see.
Security professionals will often have competing workloads and have to
deal with a lot of information on a daily basis.
You've seen the benefits of using TruffleHog,
but we also want each tool we use to help rather than slow your progress.
In this section,
you will see how to create custom search criteria using TruffleHog.
We will customize TruffleHog to search for Azure Storage keys as an example.
Customizing search criteria is incredibly useful because with it,
we can reduce the amount of results to a level that
you can realistically handle, but more importantly,
customizing TruffleHog to your own specific use cases means
you will only get alerts that matter to you,
and this helps to reduce things like false positives that can really
consume a lot of time and resource investigating.
The example scenario we'll be using is a security engineer.
She notices that developers in her organization are
using Azure Storage containers.
The engineer is concerned that keys to access these containers will be
accidentally committed to GitHub. To be able to help mitigate this risk,
she wants to be able to detect keys committed to the repo and needs to
configure and document this process.
This can then be used throughout the organization as a repeatable process.
The first place to begin is having some sample Azure
Storage keys, and this is really important.
Do not use any active keys for testing and development as there is a
risk of compromise if you do. I would recommend generating a key in
Azure, copy the key, and then expire it.
Alternatively,
search online for some examples if you do not have access to
Azure. TruffleHog can use regular expressions to find
credentials, and this is known as regex.
This is a subject in its own right,
so I'll not be able to cover the subject in this course.
If you cannot find a regular expression for a specific purpose,
then you'll need to create it yourself, and this will require some testing.
I'm going to use a website called regex101.com.
Looking at the Azure key I'm using, there are
alphanumerics, so letters and numbers.
There's also a plus character and two equal characters at the end.
The length of the key is 88 characters, and with that,
there's enough to build a regular expression.
Next, we need to configure TruffleHog to be able to use
this regular expression. To do that,
locate the file regexes.json. This file is managed by TruffleHog and is
copied to your machine at the time of installation.
The location may vary on your system.
Okay, I'll find a line to insert our new search term and
need to follow the format of this file.
It's recommended to back up the file before making a change and be
sure to include the trailing comma if this is not the last line in
the file. Save that and close. Go to the terminal, and let's test
this. Let's type TruffleHog.
We want to enable regex, without this, the test will
fail, and we want to turn off entropy.
There is a test repo here that you can use that has been
set up for this course. Success! We can see that these
keys are detected in this repo.
From this point, you would want to document this process so
it's repeatable and look to provide this to development teams
that are using Azure Storage keys.
I would also recommend storing the regexes.json file in an internal
repo so that all developers will be able to access and use as a
reference to mature their capability.