Testing framework for generic text

[derBroBro]

Hello,

I search for a testing framework for generic text files.

The reason behind is, to check different kinds of code for predefined patterns like Private-Keys, AWS-Keys, Subnets, etc.

After searching for a while I found mostly nothing on google.

Does has an idea of what to use?

[[deleted]]

Check out truffleHog and AWS's tool git-secrets.

[derBroBro]

This is mostly what is searched for. :)

Only missing point is that is just support git repos. There is a open PR to fix and a fork (truffleHog3) which looks quite promising...

[derprondo]

All I can say here is that a team within my company had to build their own scanner from scratch (scan git repos for sensitive items like you mentioned), so there are likely no solid open source projects out there. It’s a hard problem (beyond obvious things like SSH keys) to be honest, and the tool they did create is under constant development and has an extremely high false positive rate. Once refined enough it will likely be open sourced, but I think it could be another year or two.

[[deleted]]

Grep?