eth0izzle/shhgit
Shhgit
shhgit is a static analysis security tool and secret detection scanner designed to identify leaked credentials, API tokens, and private keys. It functions as a security auditor for version control systems, analyzing both local files and remote repositories across platforms including GitHub, GitLab, and Bitbucket.
The tool utilizes a detection engine based on signature-matching, custom regular expressions, and entropy checks to locate sensitive data. It allows for the use of custom search signatures and queries to identify non-standard secrets that may not be covered by predefined patterns.
The scanning surface extends to remote repository metadata, such as issue comments, and includes filtering capabilities to exclude specific file extensions or directory paths. Results can be exported via CSV files or transmitted through webhook notifications.
Features
- Repository Content Scanning - Detects leaked credentials by programmatically scanning codebase contents and metadata via public version control APIs.
- Git Repository Security Auditors - A scanner for identifying exposed secrets within GitHub, GitLab, and Bitbucket repositories using signatures and regular expressions.
- Secret Detection Tools - Scans source code and configuration files for accidentally committed credentials, private keys, and API tokens.
- Credential Audit Scanning - Searches GitHub, GitLab, and Bitbucket repositories for leaked secrets using custom signatures.
- Secret Detection Pipelines - Automates the discovery of secrets in code before or after commits to prevent security breaches.
- Custom Regex Pattern Matching - Implements custom regular expression searching to identify non-standard secrets within files.
- Custom Secret Patterns - Uses entropy checks and user-defined regex patterns to find non-standard secrets in source code.
- Local Repository Secret Scanning - Analyzes files in local directories and repositories to identify leaked secrets for automated pipelines.
- Secret Scanning Engines - Provides the core engine for detecting hardcoded credentials in code repositories.
- Custom Detection Signatures - Identifies specific secrets using custom text matches, regular expressions, and entropy checks.
- Secret Signatures - Identifies sensitive data by comparing file content against a library of regular expressions and entropy-based criteria.
- Content-Based Secret Signatures - Matches code against a library of predefined signatures or custom queries to identify specific credentials.
- Static Analysis Security Testing - Analyzes source code without executing it to find security vulnerabilities and leaked credentials.
- Path Exclusions - Allows ignoring specific file paths or directories during scanning to reduce false positives.
- Remote Repository Discovery - Fetches repository contents and metadata from external version control platforms using public REST interfaces.
- Scan Result Filters - Applies custom logic to exclude specific strings, extensions, or paths to reduce noise and false positives.
- Attack Surface Mapping - Analyzes repositories to identify potential entry points and leaked authentication tokens for security assessment.
- Code and Secret Discovery - Real-time secret detection for code repositories.
- Web Tools - Listed in the “Web Tools” section of the The Book Of Secret Knowledge awesome list.
- Secret Scanning - Finds secrets across codebases to prevent security breaches.
- Sensitive Data Leakage - Real-time monitor for secrets across GitHub repositories.
