菜单
Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill performing-paste-site-monitoring-for-credentials命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
正在显示 SKILL.md
基于 SOC 职业分类
| name | performing-paste-site-monitoring-for-credentials |
| description | Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early. |
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["paste-monitoring","credential-leak","pastebin","data-breach","threat-intelligence","osint","early-warning"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
| mitre_attack | ["T1591","T1592","T1593","T1589","T1003"] |
| mitre_f3 | {"version":"1.1","tactics":["reconnaissance","resource-development","initial-access"],"techniques":[{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"T1593.002","name":"Search Open Websites/Domains: Search Engines","tactic":"reconnaissance","source":"attack"},{"id":"T1650","name":"Acquire Access","tactic":"resource-development","source":"attack"},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactic":"reconnaissance","source":"attack"},{"id":"T1110.004","name":"Brute Force: Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"}]} |
Paste sites (Pastebin, GitHub Gists, Ghostbin, Dpaste, Hastebin) are frequently used as staging areas for leaked credentials, database dumps, API keys, and sensitive data before wider distribution on dark web forums and Telegram channels. Monitoring these sites provides early breach detection, enabling organizations to respond before stolen data is weaponized. This skill covers building automated paste site monitors using the Pastebin Scraping API, keyword-based alerting, credential pattern matching, and integration with incident response workflows.
requests, beautifulsoup4, regex, pymisp librariesOver 300,000 user credentials are posted on Pastebin annually, averaging 1,000 username/password pairs per leak. Paste sites serve three primary threat intelligence purposes: early breach detection (credentials appear on paste sites before dark web), threat actor profiling (actors use paste sites for C2 configuration, data staging, tool sharing), and malware discovery (encoded payloads, configuration files, C2 addresses).
Active monitoring queries paste site APIs or scraping endpoints at regular intervals. The Pastebin Scraping API provides real-time access to new public pastes. For GitHub, the search API allows monitoring Gists and repository commits for exposed secrets. Passive monitoring uses services like IntelX, Dehashed, or Have I Been Pwned that aggregate paste site data.
Effective monitoring uses regex patterns for email:password combinations, API keys (AWS, Azure, GCP, Stripe, Twilio), database connection strings, private keys (SSH, PGP), JWT tokens, and internal hostnames/URLs. Organization-specific keywords (domain names, product names, employee names) reduce false positives.
requests
re
json
time
datetime datetime
:
SCRAPING_URL =
RAW_URL =
():
.keywords = [k.lower() k keywords]
.output_dir = output_dir
.seen_keys = ()
.credential_patterns = {
: re.(
, re.IGNORECASE),
: re.(
),
: re.(
),
: re.(
),
: re.(
),
: re.(
),
: re.(
),
: re.(
),
: re.(
,
re.IGNORECASE),
}
():
params = {: limit}
:
resp = requests.get(.SCRAPING_URL, params=params, timeout=)
resp.status_code == :
pastes = resp.json()
()
pastes
:
()
[]
Exception e:
()
[]
():
params = {: paste_key}
:
resp = requests.get(.RAW_URL, params=params, timeout=)
resp.status_code == :
resp.text
Exception:
():
findings = {
: [],
: {},
: ,
}
content_lower = content.lower()
keyword .keywords:
keyword content_lower:
count = content_lower.count(keyword)
findings[].append({
: keyword,
: count,
})
pattern_name, pattern .credential_patterns.items():
matches = pattern.findall(content)
matches:
findings[][pattern_name] = {
: (matches),
: matches[:],
}
cred_count = (
m[] m findings[].values()
)
findings[] cred_count > :
findings[] =
findings[]:
findings[] =
cred_count > :
findings[] =
cred_count > :
findings[] =
findings
():
count =
iterations count < iterations:
pastes = .fetch_recent_pastes()
alerts = []
paste pastes:
paste_key = paste.get(, )
paste_key .seen_keys:
.seen_keys.add(paste_key)
content = .get_paste_content(paste_key)
content:
findings = .analyze_paste(content, paste)
findings[] != :
alert = {
: paste_key,
: paste.get(, ),
: paste.get(, ),
: paste.get(, ),
: paste.get(, ),
: ,
: findings,
: datetime.now().isoformat(),
}
alerts.append(alert)
(
)
alerts:
._save_alerts(alerts)
count +=
iterations count < iterations:
time.sleep(interval)
alerts
():
filename =
os
os.makedirs(.output_dir, exist_ok=)
(filename, ) f:
json.dump(alerts, f, indent=)
()
monitor = PastebinMonitor(
keywords=[, , ],
)
alerts = monitor.monitor_loop(interval=, iterations=)
class GitHubSecretMonitor:
def __init__(self, github_token, org_keywords):
self.token = github_token
self.keywords = org_keywords
self.headers = {
"Authorization": f"token {github_token}",
"Accept": "application/vnd.github.v3+json",
}
def search_code(self, query, per_page=30):
"""Search GitHub code for leaked secrets."""
url = "https://api.github.com/search/code"
params = {"q": query, "per_page": per_page}
resp = requests.get(url, headers=self.headers, params=params)
if resp.status_code == 200:
results = resp.json().get("items", [])
print(f"[+] GitHub code search: {len(results)} results for '{query}'")
return results
return []
def search_gists(self, keyword):
"""Search public Gists for sensitive data."""
url = "https://api.github.com/gists/public"
params = {"per_page": 100}
resp = requests.get(url, headers=self.headers, params=params)
matches = []
if resp.status_code == 200:
gists = resp.json()
for gist in gists:
description = (gist.get("description") or "").lower()
files = gist.get("files", {})
for filename, file_info in files.items():
if keyword.lower() in description or keyword.lower() in filename.lower():
matches.append({
"gist_id": gist["id"],
"description": gist.get("description", ""),
"filename": filename,
"url": gist["html_url"],
"created_at": gist["created_at"],
})
return matches
def monitor_org_secrets(self, org_domain):
"""Monitor for organization secrets leaked on GitHub."""
queries = [
f'"{org_domain}" password',
f'"{org_domain}" api_key',
f'"{org_domain}" secret',
f'"{org_domain}" token',
f'"{org_domain}" credentials',
]
all_findings = []
for query in queries:
results = self.search_code(query)
for result in results:
all_findings.append({
"query": query,
"repo": result.get("repository", {}).get("full_name", ""),
"path": result.get("path", ""),
"url": result.get("html_url", ""),
"score": result.get("score", 0),
})
time.sleep(10) # GitHub rate limiting
return all_findings
gh_monitor = GitHubSecretMonitor("YOUR_GITHUB_TOKEN", ["mycompany.com"])
findings = gh_monitor.monitor_org_secrets("mycompany.com")
def generate_credential_leak_alert(alert_data):
"""Generate incident alert for credential leak detection."""
alert = {
"title": f"Credential Leak Detected - {alert_data.get('severity', 'unknown').upper()}",
"source": alert_data.get("url", ""),
"detected_at": alert_data.get("detected_at", ""),
"severity": alert_data.get("severity", "medium"),
"summary": f"Paste containing organization keywords and credentials found",
"keyword_matches": alert_data.get("findings", {}).get("keyword_matches", []),
"credential_types": list(alert_data.get("findings", {}).get("credential_matches", {}).keys()),
"recommended_actions": [
"Verify if leaked credentials are valid",
"Force password reset for affected accounts",
"Rotate exposed API keys and tokens",
"Check access logs for unauthorized usage",
"Report paste for takedown",
"Update monitoring keywords if new patterns found",
],
}
return alert