Procedure examples

TruffleHog has gathered data from home directories of the victim environment.

TruffleHog has leveraged Cloud CLI in order to enumerate and gather credentials.

TruffleHog has used stolen credentials to log into cloud services to access cloud hosted repositories and other cloud storage solutions to discover sensitive data to include API Keys, tokens and credentials.

TruffleHog has can browse and scan individual files and directories.

TruffleHog has collected credentials and data associated with Confluence.

TruffleHog has searched SharePoint for data and credentials.

TruffleHog has gathered data and credentials from code repositories.

TruffleHog has obtained data and credentials associated with messaging applications to include Slack.

TruffleHog has the ability to scan code repositories and CI/CD platforms.

TruffleHog has gathered access tokens and API tokens from CI/CD pipeline solutions and repositories.

TruffleHog has the ability to scan cloud storage services for credentials to include Amazon (AWS) S3 and Google Cloud Storage.

TruffleHog has obtained credentials stored in config files and credential files in victim environments.

TruffleHog can query the AWS and GCP metadata endpoints for instances and service credentials.

TruffleHog can obtain secrets from AWS Secrets and GCP Secret Manager. TruffleHog has also gathered passwords, secrets and API keys from source repositories, .env files, and git history.

TruffleHog can enumerate AWS Infrastructure to include EC2 instances.

TruffleHog can enumerate cloud storage environments including Amazon Web Service (AWS) S3 buckets and Google Cloud Storage buckets.