porch-pirate

Porch Pirate Porch Pirate 最初是一款快速发现 Postman 秘密的工具，后来逐渐发展成针对 Postman 的多用途侦察/OSINT 框架。现有工具虽然是很好的概念验证，但它们仅尝试将非常特定的关键词识别为“秘密”，且仅限于有限的位置，完全没有考虑除秘密之外的侦察。我们意识到需要具备“秘密无关”的能力，并且要有足够的灵活性来捕获仍具有攻击价值的误报。 Porch Pirate 枚举并呈现来自可公开访问的 Postman 实体（例如）的敏感结果（全局秘密、独特头部、端点、查询参数、授权等）： 工作区 Workspaces 集合 Collections 请求...

Porch-Pirate - The Most Comprehensive Postman Recon / OSINT Client And Framework That Facilitates The Automated Discovery And Exploitation Of API Endpoints And Secrets Committed To Workspaces, Collections, Requests, Users And Teams

Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and in very...