Projects sharing features with SecretFinder

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

Gitrob is a tool that scans public GitHub repositories for potentially sensitive files. It clones repositories and walks through their full commit history to flag files matching signatures for sensitive content, including files that may have been deleted in later commits. The tool presents its findings through a local web interface for interactive browsing and analysis. It serves results directly from memory without requiring a database, and allows users to save the full set of gathered findings to a JSON session file. Saved sessions can be loaded back into the web interface to continue analy

Automation for javascript recon in bug bounty.

Arjun is an HTTP parameter discovery tool that identifies valid parameters on web endpoints by testing large dictionaries of parameter names against target URLs. It systematically probes endpoints using GET, POST, JSON, and XML request formats to find which parameters the server accepts, and can detect parameters whose values appear reflected in the response body. The tool distinguishes itself through its multi-method scanning approach, passive parameter collection from public archives like OTX and CommonCrawl, and its ability to detect value-sensitive parameters that only trigger a response

Gitleaks is a static analysis security tool and secret detection engine designed to find hardcoded passwords, API keys, and authentication tokens. It functions as a Git secret scanner that analyzes both local file systems and Git commit history to prevent credential leaks. The tool distinguishes itself through a decoding pipeline that transforms base64 and hex strings into plaintext to find obfuscated secrets. It further reduces false positives using proximity-based validation and fingerprint-based suppression to filter out known or baseline findings. The system covers a broad range of detec

Tool for advanced mining for content on Github

gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws. It functions as a security analyzer that inspects the abstract syntax tree to identify insecure function calls, API usage, and potential security risks. The tool distinguishes itself by mapping detected vulnerabilities to Common Weakness Enumeration identifiers for standardized reporting and integrating with external AI models to suggest code fixes for identified issues. Its capabilities cover the detection of injection vulnerabilities, hardcoded credentials, weak cryptograph

SpringBootVulExploit is a collection of scanning and auditing tools designed to identify vulnerabilities, information leaks, and execution vectors within Java-based application frameworks, specifically targeting Spring Boot applications. It provides a suite of exploit techniques, payloads, and security checklists for performing vulnerability analysis. The project features capabilities for triggering remote code execution through injection vectors, deserialization payloads, and malicious configuration files. It includes a scanner for detecting exposed environment variables and internal routing

Unredacter is a computer vision text reconstructor and image forensics utility designed to recover hidden characters from pixelated images. It functions as a tool for reversing pixelation to identify text within obscured visual blocks. The system uses a process of comparing pixelated image blocks against rendered candidate characters that match the typographic styles of the target text. This allows for the reconstruction of obscured information through automated visual analysis. The project covers capabilities for digital forensics analysis, image redaction testing, and information leakage a

Extract URLs, paths, secrets, and other interesting bits from JavaScript

Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

A tool to capture all the git secrets by leveraging multiple open source git searching tools

Search exposed EBS volumes for secrets

EarlyBird is a sensitive data detection tool capable of scanning source code repositories for clear text password violations, PII, outdated cryptography methods, key files and more.

Sublist3r is a subdomain enumeration tool and passive reconnaissance framework designed to discover subdomains by querying search engines and public intelligence sources. It functions as a security tool for identifying the digital footprint of a target domain. The project provides both passive enumeration through multi-source API aggregation and active discovery via a DNS brute force tool. It includes a TCP port scanner to identify active services and open ports on discovered subdomains, facilitating attack surface mapping. The tool can be used as a standalone utility or as a Python security

Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.

jsleak is a tool to find secret , paths or links in the source code during the recon.

Finding potential software vulnerabilities from git commit messages

Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.

云资产管理工具 目前工具定位是云安全相关工具，目前是两个模块 云存储工具、云服务工具， 云存储工具主要是针对oss存储、查看、删除、上传、下载、预览等等 云服务工具主要是针对rds、服务器的管理，查看、执行命令、接管等等

BLUTO DNS Recon | Brute Forcer | DNS Zone Transfer | DNS Wild Card Checks | DNS Wild Card Brute Forcer | Email Enumeration | Staff Enumeration | Compromised Account Enumeration | MetaData Harvesting