在线时间:8:00-16:00
迪恩网络APP
随时随地掌握行业动态
扫描二维码
关注迪恩网络微信公众号
开源软件名称:hisxo/gitGraber开源软件地址:https://github.com/hisxo/gitGraber开源编程语言:Python 100.0%开源软件介绍:About gitGrabergitGraber is a tool developed in Python3 to monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon (AWS), Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe, Twilio... How it works ?It's important to understand that gitGraber is not designed to check history of repositories, many tools can already do that great. gitGraber was originally developed to monitor and parse last indexed files on GitHub. If gitGraber find something interesting, you will receive a notification on your Slack channel. You can also use it to have results directly on the command line. In our experience, we are convinced that leaks do not come only from the organizations themselves, but also from service providers and employees, who do not necessarily have a "profile" indicating that they work for a particular organization. Regex are supposed to be as accurate as possible. Sometimes, maybe you will have false-positive, feel free to contribute to improve recon and add new regex for pattern detection. We prefer to reduce false positive instead of sending notification for every "standard" API keys which could found by gitGraber but irrelevant for your monitoring. F.A.QWhy I only see "Github query" and "Status code : 200" in output ?gitGraber display some things directly in the CLI: GitHub request, status code abuse detection (200 or 403)... and if you don't see something like About the error message "Abuse detection reached for token"This message appears when GitHub detects a large number of requests from your own GitHub token. Don't worry, gitGraber can handle this and it will try to use another token defined in the Do I will receive same tokens for same repository every time that I run gitGraber ?No, to avoid this, gitGraber stores all repository URLs in a file named How do I set a blacklisted pattern for a specific token ?You have to edit the tokens.py file and add the pattern as a list argument when initializing the token. FFor example, to add the pattern XXXX to the MAILCHIMP token, the line Usage
For example, to search for a specific word in github in combination with each word of the file keywordsfile.txt and output it to Slack :
It is possible to search for a specific domain name for example, but this has to be surrounded by double quotes :
If you want to build a custom wordlist based on the files found on Github to use it then with your favorite fuzzing tool, add argument
If you want to monitor your search query every 30 mins you can use the
The above will search for secrets every 30 min on your search query & send you a slack notification whenever there are any hits. DependenciesgitGraber needs some dependencies, to install them on your environment:
ConfigurationBefore to start gitGraber you need to modify the configuration file
To start gitGraber : Which API Keys & services are supported ? (Last update : September 12th, 2019)Currently, gitGraber supports 31 different tokens. All of these detection models (regex) are stored in the file
Wordlists & ResourcesSome wordlists & regex have been created by us and some others are inspired from other repos/researchers :
TODO
Authors
ContributorsThanks for your contribution and for your help to improve gitGraber: DisclaimerThis project is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. Developers assume no liability and are not responsible for any misuse or damage caused by this tool. |
2023-10-27
2022-08-15
2022-08-17
2022-09-23
2022-08-13
请发表评论