4 ms·

Monitor PasteBin for Your Email or Passwords

35 points by skadamat 13y ago

DjangoReinhardt 13y ago
Good work! Just a suggestion: You should probably look to collaborate with this guy: https://haveibeenpwned.com/ https://haveibeenpwned.com/ The two of you together can help us (l)users know when we've been pwned...
- shayanjm 13y ago
  Creator of the project here. Thanks for the suggestion! I'll look into it
deleted 13y ago
[deleted]
switch33 13y ago
What's to prevent a hacker from compromising a computer then checking config scripts for the monitor?
- shayanjm 13y ago
  This is meant to be deployed as a SaaS (hence, why there are user management features included). There are two possible scenarios here: #1 - Hacker breaks into your production server and steals your config files #2 - Hacker breaks into your dev computer and steals your config files If either of these things happen, I think you have a bigger security issue than any you might find on Pasteye.
- johndoze 13y ago
  At that point you might as well take all those wide open Chrome passwords. https://news.ycombinator.com/item?id=6166731 https://news.ycombinator.com/item?id=6166731
afreak 13y ago
Whoa. Nice to see someone else doing what I am already doing. https://canary.pw https://canary.pw New version is coming out this week that lets you search via relation.
- shayanjm 13y ago
  That's an awesome project. Have you open sourced it? Also, just to draw the distinction: Pasteye is for near-realtime monitor notifications, and it seems like Canarypw is more like an archival search.
  - afreak 13y ago
    This project isn't open-sourced but there is an API in the works. I am going to be presenting some of its abilities at BSides Vancouver next month. [edit] I should add that a component of it might be open-sourced but I haven't had much time to digest the idea of doing so.
scottlinux 13y ago
Might also be of related interest: https://twitter.com/dumpmon https://twitter.com/dumpmon
- shayanjm 13y ago
  Conceptually, the same thing. Only difference is I abstracted my project as a SaaS (that took forever) so you didn't _have_ to run your own instance. Also, I wrote mine in Node (scrape parsing & RESTful APIs just SCREAM async), while dumpmon is written in Python
- jwcrux 13y ago
  Hi there! Author of @dumpmon here. If you are interested, the entire project is open-sourced here: https://github.com/jordan-wright/dumpmon https://github.com/jordan-wright/dumpmon I'm planning a solid revision sometime soon!
twstdroot 13y ago
speaking from experience (https://github.com/bryanbrannigan/pastebin-parser https://github.com/bryanbrannigan/pastebin-parser) if you are just grabbing the pastes from the "latest" box you are missing a lot. To grab everything we actually had to create a distributed setup or else pastebin would start banning our IPs.
- shayanjm 13y ago
  I ran into that issue myself. Pastebin throttling is real. I was playing around with the idea of actually using the socks5 proxies gathered through scraping in order to retain modularity (and eliminate the necessity of multi-IP set ups which could easily get pricey). It would be tough because I would have to check the health of each proxy prior to use (so that I don't miss out on request windows), but still an interesting concept to consider.
  - twstdroot 13y ago
    cheap VPS boxes from lowendbox.com work well for this purpose. we also had problems just processing the queue on busy days.
- afreak 13y ago
  Distribution is what I ended up doing. :)
- jwcrux 13y ago
  I got around this with @dumpmon by simply playing nice with Pastebin. I discovered what limits they liked/didn't like, and adjusted accordingly. I take my entries from the archive as they are available, and I don't believe I ever miss any.
giarc 13y ago
I don't want something I have to create an account for. I want to search my email address/name/phone number on my own accord.
- shayanjm 13y ago
  Then feel free to fork and set up your own instance (hence, why I open sourced it), or use canary.pw to search through archives.
sneak 13y ago
JUST TYPE YOUR PASSWORD INTO THIS BOX, IT'S COOL.
- shayanjm 13y ago
  Source code is available, and you can use _any_ password. Inb4 not reading before posting

35 points by skadamat 13y ago

Good work! Just a suggestion: You should probably look to collaborate with this guy: https://haveibeenpwned.com/ https://haveibeenpwned.com/ The two of you together can help us (l)users know when we've been pwned...

shayanjm 13y ago
Creator of the project here. Thanks for the suggestion! I'll look into it

deleted 13y ago

[deleted]

switch33 13y ago

What's to prevent a hacker from compromising a computer then checking config scripts for the monitor?

shayanjm 13y ago
This is meant to be deployed as a SaaS (hence, why there are user management features included). There are two possible scenarios here: #1 - Hacker breaks into your production server and steals your config files #2 - Hacker breaks into your dev computer and steals your config files If either of these things happen, I think you have a bigger security issue than any you might find on Pasteye.
johndoze 13y ago
At that point you might as well take all those wide open Chrome passwords. https://news.ycombinator.com/item?id=6166731 https://news.ycombinator.com/item?id=6166731

afreak 13y ago

Whoa. Nice to see someone else doing what I am already doing. https://canary.pw https://canary.pw New version is coming out this week that lets you search via relation.

shayanjm 13y ago
That's an awesome project. Have you open sourced it? Also, just to draw the distinction: Pasteye is for near-realtime monitor notifications, and it seems like Canarypw is more like an archival search.
- afreak 13y ago
  This project isn't open-sourced but there is an API in the works. I am going to be presenting some of its abilities at BSides Vancouver next month. [edit] I should add that a component of it might be open-sourced but I haven't had much time to digest the idea of doing so.

scottlinux 13y ago

Might also be of related interest: https://twitter.com/dumpmon https://twitter.com/dumpmon

shayanjm 13y ago
Conceptually, the same thing. Only difference is I abstracted my project as a SaaS (that took forever) so you didn't _have_ to run your own instance. Also, I wrote mine in Node (scrape parsing & RESTful APIs just SCREAM async), while dumpmon is written in Python
jwcrux 13y ago
Hi there! Author of @dumpmon here. If you are interested, the entire project is open-sourced here: https://github.com/jordan-wright/dumpmon https://github.com/jordan-wright/dumpmon I'm planning a solid revision sometime soon!

twstdroot 13y ago

speaking from experience (https://github.com/bryanbrannigan/pastebin-parser https://github.com/bryanbrannigan/pastebin-parser) if you are just grabbing the pastes from the "latest" box you are missing a lot. To grab everything we actually had to create a distributed setup or else pastebin would start banning our IPs.

shayanjm 13y ago
I ran into that issue myself. Pastebin throttling is real. I was playing around with the idea of actually using the socks5 proxies gathered through scraping in order to retain modularity (and eliminate the necessity of multi-IP set ups which could easily get pricey). It would be tough because I would have to check the health of each proxy prior to use (so that I don't miss out on request windows), but still an interesting concept to consider.
- twstdroot 13y ago
  cheap VPS boxes from lowendbox.com work well for this purpose. we also had problems just processing the queue on busy days.
afreak 13y ago
Distribution is what I ended up doing. :)
jwcrux 13y ago
I got around this with @dumpmon by simply playing nice with Pastebin. I discovered what limits they liked/didn't like, and adjusted accordingly. I take my entries from the archive as they are available, and I don't believe I ever miss any.

giarc 13y ago

I don't want something I have to create an account for. I want to search my email address/name/phone number on my own accord.

shayanjm 13y ago
Then feel free to fork and set up your own instance (hence, why I open sourced it), or use canary.pw to search through archives.

sneak 13y ago

JUST TYPE YOUR PASSWORD INTO THIS BOX, IT'S COOL.

shayanjm 13y ago
Source code is available, and you can use _any_ password. Inb4 not reading before posting