• Plug&Play – one line installation with Docker.

• Scan various sources containing a set of keywords, e.g. ORGANIZATION-NAME.com.

  Currently supports:

  • GitHub
    • Repositories
    • Gists (coming soon)
  • Paste sites (e.g., PasteBin) (coming soon)

• Filter results with a built-in heuristic engine.

• Enhance results with IOLs (Indicators Of Leak):

  • Secrets in the found sources (including Git repos commits history):
    • With Shhgit (using a customized rules list).
    • With TruffleHog.
  • URIs (Including indication of your organization’s domains)
  • Emails (Including indication of your organization’s email addresses)
  • Contributors
  • Sensitive keywords (e.g., canary token, internal domains)

• Allows to ignore public sources, (e.g., “junk” repositories by web crawlers).

• OOTB ignore list of common “junk” sources.

• Acknowledge a leak, and only get notified if the source has been modified since the previous scan.

• Built-in ELK to search for data in leaks (including full index of Git repositories with IOLs).

• Notify on new leaks

• MS Teams Webhook.
• Slack Bot.
• Cortex XSOAR® (by Palo Alto Networks) Integration (WIP).

Technology Stack

• Fully Dockerized.
• API-first Python Flask backend.
• Decoupled Vue.js (3.x) frontend.
• SQLite DB.
• Async tasks with Celery + Redis queues.

Prerequisites

• Docker-Compose

Installation

• Clone the repository
• Create a local .env file

  cd Leaktopus
  cp .env.example .env

• Edit .env according to your local setup (see the internal comments).
• Run Leaktopus

  docker-compose up -d

• Initiate the installation sequence by accessing the installation API. Just open http://{LEAKTOPUS_HOST}:8000/api/install in your browser.
• Check that the API is up and running at http://{LEAKTOPUS_HOST}:8000/up
• The UI should be available at http://{LEAKTOPUS_HOST}:8080

Using Github App

In addition to the basic personal access token option, Leaktopus supports Github App authentication. Using Github App is recommended due to the increased rate limits.

1. To use Github App authentication, you need to create a Github App and install it on your organization/account. See Github’s documentation for more details.

2. After creating the app, you need to set the following environment variables:

   • GITHUB_USE_APP=True
   • GITHUB_APP_ID
   • GITHUB_INSTALLATION_ID – The installation id can be found in your app installation.
   • GITHUB_APP_PRIVATE_KEY_PATH (defaults to /app/private-key.pem)

3. Mount the private key file to the container (see docker-compose.yml for an example). ./leaktopus_backend/private-key.pem:/app/private-key.pem

* Note that GITHUB_ACCESS_TOKEN will be ignored if GITHUB_USE_APP is set to True.

Updating Leaktopus

If you wish to update your Leaktopus version (pulling a newer version), just follow the next steps.

• Pull the latest version.

  git pull

• Rebuild Docker images (data won’t be deleted).

  # Force image recreation
  docker-compose up --force-recreate --build

• Run the DB update by calling its API (should be required after some updates). http://{LEAKTOPUS_HOST}/api/updatedb

Results Filtering Heuristic Engine

The built-in heuristic engine is filtering the search results to reduce false positives by:

• Content:
  • More than X emails containing non-organizational domains.
  • More than X URIs containing non-organizational domains.
• Metadata:
  • More than X stars.
  • More than X forks.
• Sources ignore list.

API Documentation

OpenAPI documentation is available in http://{LEAKTOPUS_HOST}:8000/apidocs.

Leaktopus Services

The above can be customized by using a custom docker-compose.yml file.

Security Notes

As for now, Leaktopus does not provide any authentication mechanism. Make sure that you are not exposing it to the world, and doing your best to restrict access to your Leaktopus instance(s).

Contributing

Contributions are very welcomed.

Please follow our contribution guidelines and documentation.