noseyparker: finds secrets and sensitive information in textual data and Git history
Nosey Parker: Find secrets in textual data
Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data. It is useful both for offensive and defensive security testing.
Key features:
- It supports scanning files, directories, and the entire history of Git repositories
- It uses regular expression matching with a set of 60 patterns chosen for high signal-to-noise based on experience and feedback from offensive security engagements
- It groups matches together that share the same secret, further emphasizing signal over noise
- It is fast: it can scan at hundreds of megabytes per second on a single core and is able to scan 100GB of Linux kernel source history in less than 5 minutes on an older MacBook Pro
This open-source version of Nosey Parker is a reimplementation of part of the internal version in use at Praetorian, which has additional machine-learning capabilities. Read more in blog posts here and here.
Usage quick start
The datastore
Most Nosey Parker commands use a datastore. This is a special directory that Nosey Parker uses to record its findings and maintain its internal state. A datastore will be implicitly created by the scan command if needed. You can also create a datastore explicitly using the datastore init -d PATH command.
Scanning filesystem content for secrets
Nosey Parker has built-in support for scanning files, recursively scanning directories, and scanning the entire history of Git repositories.
For example, if you have a Git clone of CPython locally at cpython.git, you can scan its entire history with the scan command. Nosey Parker will create a new datastore at np.cpython and saves its findings there.
You can specify multiple inputs to scan at once in any combination of the supported input types (files, directories, and Git repos).
Summarizing findings
Nosey Parker prints out a summary of its findings when it finishes scanning. You can also run this step separately:
Reporting detailed findings
To see details of Nosey Parker’s findings, use the report command. This prints out a text-based report designed for human consumption:
Install
Copyright (C) 2022 praetorian-inc
