[]()
Keep your source code under control.
### **Key Features**
* **Plug&Play** – one line installation with Docker.
* **Scan various sources** containing a set of keywords, e.g. `ORGANIZATION-NAME.com`.
Currently supports:
* GitHub
* Repositories
* Gists _(coming soon)_
* Paste sites (e.g., PasteBin) _(coming soon)_
* **Filter results** with a built-in heuristic engine.
* **Enhance results with IOLs** (Indicators Of Leak):
* Secrets in the found sources (including Git repos commits history):
* With [Shhgit]( “Shhgit” ) (using a customized rules list).
* With [TruffleHog]( “TruffleHog” ).
* URIs (Including indication of your organization’s domains)
* Emails (Including indication of your organization’s email addresses)
* Contributors
* Sensitive keywords (e.g., canary token, internal domains)
* Allows to **ignore** public sources, (e.g., “junk” [repositories]( “repositories” ) by web crawlers).
* **OOTB ignore list** of common “junk” sources.
* **Acknowledge a leak**, and only get notified if the source has been modified since the previous scan.
* **Built-in ELK** to search for data in leaks (including full index of Git repositories with IOLs).
* **Notify on new leaks**
* MS Teams Webhook.
* Slack Bot.
* Cortex XSOAR® (by Palo Alto Networks) Integration _(WIP)_.
## Technology Stack
* Fully Dockerized.
* API-first Python Flask backend.
* Decoupled Vue.js (3.x) frontend.
* SQLite DB.
* Async tasks with Celery + Redis queues.
## Prerequisites
* Docker-Compose
## Installation
* Clone the repository
* Create a local .env file
cd Leaktopus
cp .env.example .env
* Edit .env according to your local setup (see the internal comments).
* Run Leaktopus
docker-compose up -d
* Initiate the installation sequence by accessing the installation API. Just open https://{LEAKTOPUS_HOST}:8000/api/install in your browser.
* Check that the API is up and running at https://{LEAKTOPUS_HOST}:8000/up
* The UI should be available at https://{LEAKTOPUS_HOST}:8080
### Using Github App
In addition to the basic personal [access token]( “access token” ) option, Leaktopus supports Github App authentication. Using Github App is recommended due to the increased rate limits.
1. To use Github App authentication, you need to create a Github App and install it on your organization/account. See [Github’s documentation]( “Github’s documentation” ) for more details.
2. After creating the app, you need to set the following environment variables:
* `GITHUB_USE_APP=True`
* `GITHUB_APP_ID`
* `GITHUB_INSTALLATION_ID` – The installation id can be found in [your app installation]( “your app installation” ).
* `GITHUB_APP_PRIVATE_KEY_PATH` (defaults to `/app/private-key.pem`)
3. Mount the private key file to the [container]( “container” ) (see `docker-compose.yml` for an example). `./leaktopus_backend/private-key.pem:/app/private-key.pem`
_* Note that `GITHUB_ACCESS_TOKEN` will be ignored if `GITHUB_USE_APP` is set to `True`._
## Updating Leaktopus
If you wish to update your Leaktopus version (pulling a newer version), just follow the next steps.
* Pull the latest version.
git pull
* Rebuild Docker images (data won’t be deleted).
# Force image recreation
docker-compose up –force-recreate –build
* Run the DB update by calling its API (should be required after some updates). https://{LEAKTOPUS_HOST}/api/updatedb
## Results Filtering Heuristic Engine
The built-in heuristic engine is filtering the search results to reduce false positives by:
* Content:
* More than X emails containing non-organizational domains.
* More than X URIs containing non-organizational domains.
* Metadata:
* More than X stars.
* More than X forks.
* Sources ignore list.
## API Documentation
OpenAPI documentation is available in https://{LEAKTOPUS_HOST}:8000/apidocs.
## Leaktopus Services
Service | Port | Mandatory/Optional
—|—|—
Backend (API) | 8000 | Mandatory
Backend (Worker) | N/A | Mandatory
Redis | 6379 | Mandatory
Frontend | 8080 | Optional
Elasticsearch | 9200 | Optional
Logstash | 5000 | Optional
Kibana | 5601 | Optional
_The above can be customized by using a custom docker-compose.yml file._
## Security Notes
As for now, Leaktopus does not provide any [authentication]( “authentication” ) mechanism. Make sure that you are not [exposing]( “exposing” ) it to the world, and doing your best to **restrict access to your Leaktopus instance(s)**.
## Contributing
Contributions are very welcomed.
Please follow our [contribution guidelines and documentation]( “contribution guidelines and documentation” ).
**[Download Leaktopus]( “Download Leaktopus” )**Read More