Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,40 @@ deduplicated, attributed to the author who committed it, and ranked by a blast-r
Revoking a leaked credential without rotating it is not enough. GitHub keeps the commit
objects, so the secret stays reachable by its SHA. Revenant is built to find those.

Built and maintained by [smakarim](https://github.com/smakarim).

## Why

TruffleHog, Gitleaks, and GitHound scan the current state of repositories you already know
about. The deleted and force-pushed surface, where credentials get "removed" and forgotten,
is not covered by those tools. Revenant targets that surface and folds the ordinary history
scan into the same run, so you do not have to stitch several tools together.

## How Revenant compares

Revenant is a reconnaissance and orchestration layer. It uses TruffleHog as its detection and
verification engine and adds the surfaces and correlation that the tools below do not combine
on their own. The table reflects each tool's documented, out-of-the-box behavior.

| Capability | Revenant | TruffleHog | Gitleaks | GitHound | GitDorker |
|---|---|---|---|---|---|
| Reachable git history scan | Yes | Yes | Yes | Yes | No |
| Deleted / force-pushed commit recovery | Yes | Yes (1) | No | No | No |
| Live secret verification | Yes (2) | Yes | No | No | No |
| GitHub-wide code-search dorking | Yes | No | No | Yes | Yes |
| Gist scanning | Yes | Yes | No | Yes | No |
| Org member footprint enumeration | Yes | Partial | No | No | No |
| Key scope / permission analysis | Yes (GitHub) | Yes | No | No | No |
| Developer correlation and blast-radius ranking | Yes | No | No | No | No |

1. TruffleHog recovers deleted and private commits with its experimental
`github-experimental --object-discovery` mode. Revenant instead reads the repository
activity log, which is immediate and does not brute-force commit hashes.
2. Revenant does not reimplement detection. It runs TruffleHog for detection and verification,
so its value is breadth and correlation rather than better detectors: reachable history,
deleted commits, gists, and code-search dorking in one pass, deduplicated, attributed to the
author, and ranked.

## Features

- Scans reachable history, deleted and force-pushed commits, and gists in one run. Every
Expand Down
12 changes: 12 additions & 0 deletions cmd/revenant/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,17 @@ import (
"github.com/smakarim/revenant/internal/target"
)

const banner = `
____ _
| _ \ _____ _____ _ __ __ _ _ __ | |_
| |_) / _ \ \ / / _ \ '_ \ / _' | '_ \| __|
| _ < __/\ V / __/ | | | (_| | | | | |_
|_| \_\___| \_/ \___|_| |_|\__,_|_| |_|\__|

Recover deleted GitHub commits and scan them for live secrets
by smakarim
`

func buildSpec(org, user string, repos []string, reposFile string) (target.Spec, error) {
set := 0
if org != "" {
Expand Down Expand Up @@ -47,6 +58,7 @@ func main() {
Use: "revenant",
Short: "Recover deleted/force-pushed GitHub commits and find live secrets",
RunE: func(cmd *cobra.Command, args []string) error {
fmt.Fprint(os.Stderr, banner)
spec, err := buildSpec(org, user, repos, reposFile)
if err != nil {
return err
Expand Down
Loading