67

GitHub - hisxo/gitGraber: gitGraber is a tool developed in Python3 to monitor Gi...

 5 years ago
source link: https://github.com/hisxo/gitGraber
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

README.md

gitgraberlogo

made with python 3.x 68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6973737565732f686973786f2f6769746772616265722e737667

About gitGraber

gitGraber is a tool developed in Python3 to monitor GitHub to search and find sensitive data for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

demo

How it work ?

It's important to understand that gitGraber is not designed to check history of repositories, many tools can already doing this great. gitGraber was originally developed to monitor and to parse last indexed files on GitHub. If gitGraber find something interesting, you will receive a notification on your Slack channel. You can also use it to have results directly on the command line.

In our experience, we are convinced that leaks do not come only from the organizations themselves, but also from service providers and employees, who do not necessarily have a "profile" indicating that they work for a particular organization. .

Regex are supposed to be the more precise than possible. Sometimes, maybe you will have false-positive, feel free to contribute to improve recon and add new regex for pattern detection.

We prefer to reduce false positive instead to send notification for every "standard" API key which could found by gitGraber but irrelevant for hunter.

How to use gitGraber ?

usage: gitGraber.py [-h] [-k KEYWORDSFILE] [-q QUERY] [-s] [-w WORDLIST]

optional arguments:
  -h, --help            show this help message and exit
  -k KEYWORDSFILE, --keyword KEYWORDSFILE
                        Specify a keywords file (-k keywordsfile.txt)
  -q QUERY, --query QUERY
                        Specify your query (-q "apikey")
  -s, --slack           Enable slack notifications
  -w WORDLIST, --wordlist WORDLIST
                        Create a wordlist that fills dynamically with
                        discovered filenames on GitHub

Dependencies

gitGraber needs some dependencies, to install them on your environment:

pip3 install -r requirements.txt

Configuration

Before to start gitGraber you need to modify the configuration file config.py :

  • Add your own Github tokens : GITHUB_TOKENS = ['yourToken1Here','yourToken2Here']
  • Add your own Slack Webhook : SLACK_WEBHOOKURL = 'https://hooks.slack.com/services/TXXXX/BXXXX/XXXXXXX'

How to create Slack Webhook URL

To start and use gitGraber : python3 gitGraber.py -k wordlists/keywords.txt -q "uber" -s

We recommend creating a cron that will execute the script regulary:

*/10 * * * * cd /BugBounty/gitGraber/ && /usr/bin/python3 gitGraber.py -k wordlists/keywords.txt -q "uber" -s >/dev/null 2>&1

Wordlists & Resources

Some wordlists have been created by us and some others are inspired from other repo/researcher

TODO

  • Add more regex & patterns
  • Add a "combo check" module (for services like Twilio that require two tokens)
  • Add multi threads
  • Add bearer token detections
  • Change token cleaning output
  • Add user and org names display in notifications

Authors

Disclaimer

This project is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. Developers assume no liability and are not responsible for any misuse or damage caused by this tool.


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK