Truffle Hog Integration
Summary: PortSwigger's BApp Store lists a TruffleHog extension for Burp Suite, authored by Truffle Security at version 1.0.0 and last updated 11 March 2025, that scans Burp traffic for 800+ types of secrets such as API keys, passwords and SSH keys. The extension runs TruffleHog every 10 seconds, separates request and response headers from body content to add keyword context, and by default verifies each secret found via an HTTP request so only live secrets are shown.
Key Takeaway: The default setting only surfaces secrets that verify as live, so a scan can confirm which credentials in your traffic are usable right now - and the extension scans only Proxy traffic unless reconfigured, leaving other traffic unchecked.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026