cosad3s/postleaks

Search for sensitive data in Postman public library.

Hi there 👋

I am Sébastien Copin (cosad3s or cosades), cybersecurity freelancer & researcher - occasionally you will find here some of the tools or scripts I create or modify for hacking and bug bounty purposes 🏴‍☠️ 🛠️

💬 Do not hesitate to contact me through my personal website (form), Twitter or LinkedIn for anything.

postleaks's Issues

Feature Request (multiple keywords at once)

Hi, cosad3s

Is there any possibility to implement the following function, namely to pass the list of keywords via -kf file, instead of searching one by one, as it is implemented now?

> cat keywords

google.com
tesla.com
apple.com

Thanks in advance!

Error, configuration file postleaks/config.yml does not exist

Hello cosad3s,

Python version: Python 3.7.3rc1

if nothing is found - everything is fine, but when there are finds - it crashes with an error.

The error message shows that the program is trying to find the file postleaks/config.yml using the configfile variable, but the file path is missing some folder delimiters (such as backslashes or slashes), resulting in an invalid file path.

Full trace of the error stack

[*] Looking for data in Postman.com
[*] Searching for requests IDs
[*] Search for requests info in collection of requests
[+] (ID:79eeb78c-0c93-4044-adf3-ff33353c8ca8) GET: 'https://maps.googleapis.com/maps/api/place/queryautocomplete/json?input=<string>'
 - Query parameters: [input='<string>'][offset='<number>'][location='<string>'][radius='<number>'][language='en']
Traceback (most recent call last):
  File "\\?\C:\Users\LocalUsernameHere\AppData\Local\Programs\Python\Python37\Scripts\postleaks-script.py", line 33, in <module>
    sys.exit(load_entry_point('postleaks==1.1.3', 'console_scripts', 'postleaks')())
  File "C:\Users\LocalUsernameHere\AppData\Local\Programs\Python\Python37\lib\site-packages\postleaks-1.1.3-py3.7.egg\postleaks\__main__.py", line 45, in main
    request_infos = search(args.keyword, args.include, args.exclude, args.extend_workspaces, args.raw, args.strict, output_folder)
  File "C:\Users\LocalUsernameHere\AppData\Local\Programs\Python\Python37\lib\site-packages\postleaks-1.1.3-py3.7.egg\postleaks\__main__.py", line 69, in search
    return search_request_info_for_request_ids(request_ids, include_match, exclude_match, raw, strict, keyword, output)
  File "C:\Users\LocalUsernameHere\AppData\Local\Programs\Python\Python37\lib\site-packages\postleaks-1.1.3-py3.7.egg\postleaks\__main__.py", line 144, in search_request_info_for_request_ids
    identify_secrets(f)
  File "C:\Users\LocalUsernameHere\AppData\Local\Programs\Python\Python37\lib\site-packages\postleaks-1.1.3-py3.7.egg\postleaks\__main__.py", line 150, in identify_secrets
    secrets_raw = list(whispers.secrets(f"-c {config_path} {file_path}"))
  File "C:\Users\LocalUsernameHere\AppData\Local\Programs\Python\Python37\lib\site-packages\whispers-2.2.0-py3.7.egg\whispers\__init__.py", line 18, in secrets
    return run(parse_args(argv))
  File "C:\Users\LocalUsernameHere\AppData\Local\Programs\Python\Python37\lib\site-packages\whispers-2.2.0-py3.7.egg\whispers\main.py", line 37, in run
    config = load_config(args)
  File "C:\Users\LocalUsernameHere\AppData\Local\Programs\Python\Python37\lib\site-packages\whispers-2.2.0-py3.7.egg\whispers\core\config.py", line 33, in load_config
    raise FileNotFoundError(f"{configfile.as_posix()} does not exist")
FileNotFoundError: C:UsersLocalUsernameHereAppDataLocalProgramsPythonPython37libsite-packagespostleaks-1.1.3-py3.7.eggpostleaksconfig.yml does not exist

main.py line 99 could use a try catch

main.py line 99 could use a try catch. Just to catch blanks.

File "/home/ec2-user/.local/lib/python3.6/site-packages/postleaks/main.py", line 99, in display
print("[" + d["key"] + "=" + repr(d["value"]) + "]", end='')
TypeError: must be str, not NoneType

Whispers - Cannot parse specific result with JSON containing comments

Example of error:

[ERROR] Failed parsing file 'results_1710860101/8d829aa0-e5a3-49d4-a010-b770c0ac70df.json' with {
  "id": "8d829aa0-e5a3-49d4-a010-b770c0ac70df",
  "name": "Add Enrichment",
  "data": null,
  "auth": null,
  "events": null,
  "description": "Adds an enrichment at a specified position in a defined album.\n\n### HTTP request\n\n`POST https://photoslibrary.googleapis.com/v1/albums/{albumId}:addEnrichment`\n\nThe URL uses [gRPC Transcoding](https://github.com/googleapis/googleapis/blob/master/google/api/http.proto) syntax.\n\n### Path parameters\n\n|Parameters|||\n|-|-|-|\n|`albumId`|`string`|Identifier of the album where the enrichment is to be added.|\n\n### Request body\n\nThe request body contains data with the following structure:\n\nJSON representation\n\n```json\n{\n  \"newEnrichmentItem\": {\n    object (NewEnrichmentItem)\n  },\n  \"albumPosition\": {\n    object (AlbumPosition)\n  }\n}\n```\n\n|Fields|||\n|-|-|-|\n|`newEnrichmentItem`|`object` ([NewEnrichmentItem](https://developers.google.com/photos/library/reference/rest/v1/albums/addEnrichment#NewEnrichmentItem))|The enrichment to be added.|\n|`albumPosition`|`object` ([AlbumPosition](https://developers.google.com/photos/library/reference/rest/v1/AlbumPosition))|The position in the album where the enrichment is to be inserted.|\n\n### Response body\n\nIf successful, the response body contains data with the following structure:\n\nThe enrichment item that's created.\n\nJSON representation\n\n```json\n{\n  \"enrichmentItem\": {\n    object (EnrichmentItem)\n  }\n}\n```\n\n|Fields|||\n|-|-|-|\n|`enrichmentItem`|`object` ([EnrichmentItem](https://developers.google.com/photos/library/reference/rest/v1/albums/addEnrichment#EnrichmentItem))|Output only. Enrichment which was added.|\n\n### Authorization Scopes\n\nRequires one of the following OAuth scopes:\n\n*   `https://www.googleapis.com/auth/photoslibrary`\n*   `https://www.googleapis.com/auth/photoslibrary.appendonly`\n*   `https://www.googleapis.com/auth/photoslibrary.sharing`\n\nNewEnrichmentItem\n-----------------\n\nA new enrichment item to be added to an album, used by the `albums.addEnrichment` call.\n\nJSON representation\n\n```json\n{\n\n 
  "method": "POST",
  "url": "https://photoslibrary.googleapis.com/v1/albums/{{albumId}}:addEnrichment",
  "queryParams": [],
  "headerData": []
}
Traceback (most recent call last):
  File "/home/seb/.local/lib/python3.11/site-packages/whispers/plugins/json.py", line 27, in pairs
    document = json.loads(document)
               ^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/json/decoder.py", line 353, in raw_decode
    obj, end = self.scan_once(s, idx)
               ^^^^^^^^^^^^^^^^^^^^^^
json.decoder.JSONDecodeError: Invalid control character at: line 7 column 1968 (char 2095)

Linked to issue: adeptex/whispers#127

Improve Error Handling in fail Function to Prevent Premature Exiting

Problem

Currently, the fail function in our codebase has a tendency to exit the code abruptly, hindering our ability to retrieve essential data that might still be available despite the encountered error. This behavior leads to incomplete data analysis and potentially overlooked insights.

Proposed Solution

To address this issue, we need to refactor the fail function to handle errors gracefully without exiting the code immediately. Instead, it should log the error, allowing the execution to continue and giving us the opportunity to salvage any available data. We need not always continue the code. But sometimes we should.

This is after my changes

cannot find anythig in english

Hi! I try to use you script but when I place a requests in english there is nothing found and when I use Russian its finds some. what can I do?

Whispers - Invalid control character

Some result cannot be parsed by whisper.

Example

Traceback (most recent call last):
  File "/home/seb/.local/lib/python3.11/site-packages/whispers/plugins/json.py", line 27, in pairs
    document = json.loads(document)
               ^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/json/decoder.py", line 353, in raw_decode
    obj, end = self.scan_once(s, idx)
               ^^^^^^^^^^^^^^^^^^^^^^
json.decoder.JSONDecodeError: Invalid control character at: line 29 column 15 (char 928)

(Test case internally kept for the moment)