Git Product home page Git Product logo

leaklooker-x's Introduction

LeakLooker X - GUI

Powered by Binary Edge

Discover, browse and monitor database/source code leaks

https://www.offensiveosint.io/offensive-osint-so1e07-offensive-leak-hunt-with-leaklooker

https://www.offensiveosint.io/leaklooker-gui-discover-browse-and-monitor-database-source-code-leaks/

Supported sources

  • Gitlab
  • Elasticsearch
  • Kibana
  • Sonarqube
  • Kibana
  • Jenkins
  • MongoDB
  • Rsync
  • Listing directory
  • Cassandra
  • CouchDB
  • RethinkDB
  • Anonymous FTP
  • S3 bruteforce
  • Open S3 buckets
  • Buckets in HTML
  • Github (Secrets)
  • API keys in HTML
  • Angular applications
  • Javascript (Secrets)

Requirements

  • python3
  • Binary Edge paid plan
  • django
  • celery
  • redis
  • BeautifulSoup
  • jsbeautifier
pip install -r requirements.txt
sudo apt-get install python3-jsbeautifier

Install & Run

  • Paste your Binary Edge api key into config.json
  • Paste your gmail email and password in case you want to use monitoring feature
python3 manage.py makemigrations
python3 manage.py migrate
python3 manage.py runserver

n a new window fire up redis

apt-get install redis redis-server

redis-server

In a new window (in main directory) run

celery -A leaklooker worker --loglevel=info

For scheduling task (monitoring) run also

celery -A leaklooker beat --loglevel=info

I

And server should be available on https://localhost:8000/

Guide

Useful commands https://github.com/woj-ciech/LeakLooker-X/blob/master/cheatsheet.md

Dashboard

Dashboard shows chart of retrieved databases by type

Number of confirmed/for later findings

Binary Edge credits and total amount of records in database

Progress of checking MongoDB/Cassandra/Rethink/Elastic (% of findings marked as confirmed or for later)

Random leaks by type (not confirmed nor marked for later)

Findings marked "for later" for the same random type

Notifications

Discover

  • by type

Orange "count" button counts amount of records in your database

Blue "count" button counts amount in Binary Edge

  • by keyword & network & all types at once

If there are no results (due to blacklist or they are already in db) you will be informed

Browse

  • by type (recommended)

  • whole database

Red button deletes record and put it in blacklist so it will be never displayed again

Green button confirms finding

Blue button marks it as "for later review"

Monitor

It will sent mail every 24 hours with new findings based on provided keywords/network.

It compares new results with database and blacklist and sends only new findings.

Screens

Queries

"gitlab": "title:%22gitlab%22%20AND%20web.body.content:%22register%22",
"elastic": "type:%22elasticsearch%22",
"dirs": "title:%22Index of /%22",
"jenkins": "title:%22Dashboard [Jenkins]%22",
"mongo": "type:%22mongodb%22",
"rsync": "port:873 @RSYNCD",
'sonarqube': "title:SonarQube",
'couchdb': "product:couchdb",
"kibana": "product:kibana",
"cassandra": "type:cassandra",
"rethink": "type:rethinkdb",
"ftp":"ftp.user:anonymous",
"asia":"tag:'webserver' s3.ap-southeast-1.amazonaws.com",
"europe":"tag:'webserver' s3-eu-west-1.amazonaws.com",
"north america":"tag:'webserver' s3-us-west-2.amazonaws.com",
"api_key":'web.body.content:"api_key" -web.title:swagger',
"stripe":'web.body.content:"STRIPE_KEY"',
"secret_key":'web.body.content:"secret_key" -web.title:swagger',
'google_api_key':'web.body.content:"google_api_key"'
'amazons3be':'web.body.content:ListBucketResult',
'angular':"web.body.content:polyfills web.body.content:main web.body.content:runtime"

Additional

  • I am not responsible for any damage caused by using the tool
  • You must login to the gmail account via browser first to use monitoring
  • If something does not work or you have an idea raise an issue
  • Tested on Kali Linux on newest browser
  • All credits for template goes to ColorLib

leaklooker-x's People

Contributors

danieleperera avatar j-gainsec avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

leaklooker-x's Issues

Index dump of database files

Hi, I'd love if you can add a feature where we can upload files from txt, csv, sql or json and the content of the files is indexed on a single DB. This feature would help any security researcher to index dumps of leaked databases. Usually, in my experience, the most valuable content that can be indexed using these dumped files are email addresses and passwords. What do you think about it?

Django error path

WARNINGS:
?: (2_0.W001) Your URL pattern '^celery-progress/' has a route that contains '(?P<', begins with a '^', or ends with a '$'. This was likely an oversight when migrating to django.urls.path().

Use re_path or empty string
So this error make the url inaccessible 127.0.0.1:8000

search queries

I guess im a lil ignorant but im learning! use leaklooker-x a ton

but on the github page you link to some search queries to try but it returns nothing for me. can you list some

User experience issue dropdown

Hi, I have been using LeakLooker-X GUI for last few days. I find the dropdown to select the type of DBs a little bit tedious. Most of the time I want to select all DBs so selecting one by one in a dropdown menu is hard. Maybe it would be easy to have an unordered-list of checkboxes and a checkbox 'select all'. Which selects all DBs. What do you think? I can work on it

Annotazione 2020-03-24 150045

error

──(root㉿Alpha)-[/home/user001/tools/LeakLooker-X]
└─# celery -A leaklooker worker --loglevel=info
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/vine/five.py", line 361, in
from inspect import formatargspec, getfullargspec
ImportError: cannot import name 'formatargspec' from 'inspect' (/usr/lib/python3.11/inspect.py)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/bin/celery", line 5, in
from celery.main import main
File "/usr/local/lib/python3.11/dist-packages/celery/init.py", line 17, in
from . import local # noqa
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/celery/local.py", line 17, in
from .five import PY3, bytes_if_py2, items, string, string_t
File "/usr/local/lib/python3.11/dist-packages/celery/five.py", line 7, in
import vine.five
File "/usr/local/lib/python3.11/dist-packages/vine/init.py", line 8, in
from .abstract import Thenable
File "/usr/local/lib/python3.11/dist-packages/vine/abstract.py", line 6, in
from .five import with_metaclass, Callable
File "/usr/local/lib/python3.11/dist-packages/vine/five.py", line 364, in
from inspect import formatargspec, getargspec as _getargspec # noqa
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ImportError: cannot import name 'formatargspec' from 'inspect' (/usr/lib/python3.11/inspect.py)

User error or bug?

It seems that LLX only returns 15 results on a search, even when it says there are more. For example, I ran a search that said there were ~1,300 FTP results, but I could only see 15 of them. Fortunately it only used 15 of my Binaryedge credits, but how do I see all of the results? They aren't in the DB or in the search results, and when I search again, LLX tells me the DB is up to date.

Problem with LeakLooker, macOS

So I have this error when trying to run a search with LeakLooker:

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/django/core/handlers/exception.py", line 34, in inner
    response = get_response(request)
  File "/usr/local/lib/python3.8/site-packages/django/core/handlers/base.py", line 115, in _get_response
    response = self.process_exception_by_middleware(e, request)
  File "/usr/local/lib/python3.8/site-packages/django/core/handlers/base.py", line 113, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/Users/xxx/Documents/SRC/scripts/leaklooker-NEW/LeakLooker-X-master/leaklooker_app/views.py", line 246, in stats_db
    model = apps.get_model('leaklooker_app', type)
  File "/usr/local/lib/python3.8/site-packages/django/apps/registry.py", line 210, in get_model
    return app_config.get_model(model_name, require_ready=require_ready)
  File "/usr/local/lib/python3.8/site-packages/django/apps/config.py", line 180, in get_model
    raise LookupError(
LookupError: App 'leaklooker_app' doesn't have a 'undefined' model.

Object of type 'KeyError' is not JSON serializable

[06/Sep/2020 16:24:19] "GET /keyword/search?country=&keyword=test&network=&type=Mongo HTTP/1.1" 200 68
{'pid': 2393, 'hostname': 'celery@vps-**.vps-default-host.net'}
{'state': 'STARTED', 'result': {'pid': 2393, 'hostname': 'celery@vps-**.vps-default-host.net'}}
[06/Sep/2020 16:24:19] "GET /get-task-info/?task_id=2cb32033-78e7-4f8c-b256-7b2f00425b1e HTTP/1.1" 200 98
{'pid': 2393, 'hostname': 'celery@vps-***.vps-default-host.net'}
{'state': 'STARTED', 'result': {'pid': 2393, 'hostname': 'celery@vps-**.vps-default-host.net'}}
[06/Sep/2020 16:24:19] "GET /get-task-info/?task_id=2cb32033-78e7-4f8c-b256-7b2f00425b1e HTTP/1.1" 200 98
'events'
{'state': 'FAILURE', 'result': KeyError('events',)}
Internal Server Error: /get-task-info/
Traceback (most recent call last):
  File "/home/LeakLooker-X/venv/lib/python3.6/site-packages/django/core/handlers/exception.py", line 47, in inner
    response = get_response(request)
  File "/home/LeakLooker-X/venv/lib/python3.6/site-packages/django/core/handlers/base.py", line 179, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/home/LeakLooker-X/leaklooker_app/views.py", line 183, in get_task_info
    return HttpResponse(json.dumps(data), content_type='application/json')
  File "/usr/lib/python3.6/json/__init__.py", line 231, in dumps
    return _default_encoder.encode(obj)
  File "/usr/lib/python3.6/json/encoder.py", line 199, in encode
    chunks = self.iterencode(o, _one_shot=True)
  File "/usr/lib/python3.6/json/encoder.py", line 257, in iterencode
    return _iterencode(o, 0)
  File "/usr/lib/python3.6/json/encoder.py", line 180, in default
    o.__class__.__name__)
TypeError: Object of type 'KeyError' is not JSON serializable
[06/Sep/2020 16:24:19] "GET /get-task-info/?task_id=2cb32033-78e7-4f8c-b256-7b2f00425b1e HTTP/1.1" 500 80894

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.