WEBVTT 00:00:01.840 --> 00:00:04.330 Welcome to this final demonstration using TruffleHog. 00:00:04.330 --> 00:00:07.360 Here, you will learn how to perform a customized assessment. 00:00:07.610 --> 00:00:10.780 This is a short demo, but a very important one, as you will see. 00:00:10.780 --> 00:00:14.520 Security professionals will often have competing workloads and have to 00:00:14.520 --> 00:00:17.090 deal with a lot of information on a daily basis. 00:00:17.300 --> 00:00:19.180 You've seen the benefits of using TruffleHog, 00:00:19.180 --> 00:00:23.270 but we also want each tool we use to help rather than slow your progress. 00:00:23.270 --> 00:00:24.560 In this section, 00:00:24.570 --> 00:00:28.490 you will see how to create custom search criteria using TruffleHog. 00:00:28.500 --> 00:00:32.530 We will customize TruffleHog to search for Azure Storage keys as an example. 00:00:32.820 --> 00:00:36.550 Customizing search criteria is incredibly useful because with it, 00:00:36.550 --> 00:00:39.190 we can reduce the amount of results to a level that 00:00:39.190 --> 00:00:41.860 you can realistically handle, but more importantly, 00:00:42.040 --> 00:00:45.410 customizing TruffleHog to your own specific use cases means 00:00:45.410 --> 00:00:47.360 you will only get alerts that matter to you, 00:00:47.360 --> 00:00:51.010 and this helps to reduce things like false positives that can really 00:00:51.010 --> 00:00:53.770 consume a lot of time and resource investigating. 00:00:54.040 --> 00:00:57.350 The example scenario we'll be using is a security engineer. 00:00:57.580 --> 00:01:00.410 She notices that developers in her organization are 00:01:00.410 --> 00:01:02.100 using Azure Storage containers. 00:01:02.320 --> 00:01:06.110 The engineer is concerned that keys to access these containers will be 00:01:06.110 --> 00:01:09.920 accidentally committed to GitHub. To be able to help mitigate this risk, 00:01:09.920 --> 00:01:14.020 she wants to be able to detect keys committed to the repo and needs to 00:01:14.020 --> 00:01:15.760 configure and document this process. 00:01:15.850 --> 00:01:19.670 This can then be used throughout the organization as a repeatable process. 00:01:23.540 --> 00:01:26.240 The first place to begin is having some sample Azure 00:01:26.240 --> 00:01:28.590 Storage keys, and this is really important. 00:01:28.660 --> 00:01:32.040 Do not use any active keys for testing and development as there is a 00:01:32.040 --> 00:01:36.150 risk of compromise if you do. I would recommend generating a key in 00:01:36.150 --> 00:01:38.220 Azure, copy the key, and then expire it. 00:01:38.230 --> 00:01:39.170 Alternatively, 00:01:39.170 --> 00:01:42.020 search online for some examples if you do not have access to 00:01:42.020 --> 00:01:44.980 Azure. TruffleHog can use regular expressions to find 00:01:44.980 --> 00:01:46.750 credentials, and this is known as regex. 00:01:47.360 --> 00:01:49.060 This is a subject in its own right, 00:01:49.170 --> 00:01:51.590 so I'll not be able to cover the subject in this course. 00:01:51.890 --> 00:01:54.810 If you cannot find a regular expression for a specific purpose, 00:01:54.840 --> 00:01:58.220 then you'll need to create it yourself, and this will require some testing. 00:01:58.370 --> 00:02:01.660 I'm going to use a website called regex101.com. 00:02:01.670 --> 00:02:03.730 Looking at the Azure key I'm using, there are 00:02:03.730 --> 00:02:05.980 alphanumerics, so letters and numbers. 00:02:06.220 --> 00:02:09.610 There's also a plus character and two equal characters at the end. 00:02:09.880 --> 00:02:12.780 The length of the key is 88 characters, and with that, 00:02:12.780 --> 00:02:14.660 there's enough to build a regular expression. 00:02:18.440 --> 00:02:21.210 Next, we need to configure TruffleHog to be able to use 00:02:21.210 --> 00:02:23.270 this regular expression. To do that, 00:02:23.270 --> 00:02:28.240 locate the file regexes.json. This file is managed by TruffleHog and is 00:02:28.240 --> 00:02:29.980 copied to your machine at the time of installation. 00:02:30.750 --> 00:02:32.660 The location may vary on your system. 00:02:33.440 --> 00:02:36.500 Okay, I'll find a line to insert our new search term and 00:02:36.500 --> 00:02:38.330 need to follow the format of this file. 00:02:38.450 --> 00:02:41.760 It's recommended to back up the file before making a change and be 00:02:41.760 --> 00:02:44.760 sure to include the trailing comma if this is not the last line in 00:02:44.760 --> 00:02:52.640 the file. Save that and close. Go to the terminal, and let's test 00:02:52.640 --> 00:02:56.070 this. Let's type TruffleHog. 00:02:56.080 --> 00:02:58.730 We want to enable regex, without this, the test will 00:02:58.730 --> 00:03:00.990 fail, and we want to turn off entropy. 00:03:01.250 --> 00:03:03.700 There is a test repo here that you can use that has been 00:03:03.700 --> 00:03:08.150 set up for this course. Success! We can see that these 00:03:08.150 --> 00:03:09.800 keys are detected in this repo. 00:03:09.810 --> 00:03:12.990 From this point, you would want to document this process so 00:03:12.990 --> 00:03:16.260 it's repeatable and look to provide this to development teams 00:03:16.270 --> 00:03:18.060 that are using Azure Storage keys. 00:03:18.110 --> 00:03:21.830 I would also recommend storing the regexes.json file in an internal 00:03:21.830 --> 00:03:25.440 repo so that all developers will be able to access and use as a 00:03:25.440 --> 00:03:27.460 reference to mature their capability.