Question
During a penetration test of a web application, the tester gains full access to the application's source code. The application repository includes thousands of code files. Given that the assessment timeline is very short, which of the following approaches would allow the tester to identify hard-coded credentials most effectively?
- A. Run TruffleHog against a local clone of the application. Correct
- B. Scan the live web application using Nikto.
- C. Perform a manual code review of the Git repository.
- D. Use SCA software to scan the application source code.
Explanation
TruffleHog scans a Git repository, including its commit history, or a filesystem for leaked secrets such as API keys and passwords, so running it against a local clone finds hard-coded credentials across thousands of files quickly. Nikto scans a live web server for misconfigurations and cannot see source code, a manual review is far too slow for a short timeline, and SCA tools look for vulnerable third-party dependencies rather than secrets.
