skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-paste-site-monitoring-for-credentials

Monitor Pastebin and GitHub Gists for leaked credentials using keyword and regex pattern matching.

954|172|Updated Mar 13, 2026
Search Tags:#osint#gitHub#threat-intelligence#breach-detection#credential-leak#Monitoring#pastebin
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-paste-site-monitoring-for-credentials
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-paste-site-monitoring-for-credentials
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/performing-paste-site-monitoring-for-credentials
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-paste-site-monitoring-for-credentials

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, beautifulsoup4, regex, pymisp.

What problem does it solve?

Leaked credentials, API keys, and database dumps often appear on paste sites before spreading to dark web forums, and organizations typically discover these breaches too late. This Skill automates continuous monitoring of paste sites so security teams detect exposures early and respond before stolen data is weaponized.

Core Features & Use Cases

  • Pastebin Scraping API Monitor: Polls recent public pastes, fetches raw content immediately, and analyzes it against organization-specific keywords and credential regex patterns (AWS keys, GitHub tokens, JWTs, private keys, connection strings).
  • GitHub Secret Monitoring: Searches GitHub code and public Gists for exposed secrets tied to your organization's domain, with rate-limit-aware querying.
  • Severity-Based Alerting: Classifies findings by severity, deduplicates seen pastes, and generates incident response alerts with recommended actions like credential rotation and takedown requests.
  • Use Case: A security analyst configures keywords for their company domain, runs the monitor on a schedule, and receives a critical alert when an employee's credentials appear in a new Pastebin dump, triggering password resets before attackers exploit them.

Quick Start

Set up a paste site monitor for my company domain and alert me when credentials or API keys matching our organization appear on Pastebin or GitHub Gists.

Frequently Asked Questions about performing-paste-site-monitoring-for-credentials

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I monitor Pastebin for leaked credentials?▼

Use the Pastebin Scraping API to poll recent public pastes, fetch raw content immediately, and match it against organization keywords and credential regex patterns. A Pastebin PRO account with a whitelisted IP is required for programmatic scraping access.

How to detect exposed API keys on GitHub?▼

Use the GitHub code search API with queries combining your organization domain and terms like password, api_key, secret, or token. Authenticate with a GitHub token and respect rate limits by spacing requests, since search only covers public indexed content.

What regex patterns detect leaked credentials in pastes?▼

Common patterns cover email:password pairs, AWS access keys (AKIA prefix), GitHub tokens (ghp_ prefix), Slack tokens, JWTs, private key headers, and database connection strings. Combine patterns with organization keywords to reduce false positives from example values.

Why does paste monitoring return no results sometimes?▼

Empty results often mean API throttling or IP whitelist issues rather than no leaks, so log HTTP 403 and 429 responses and retry. Private pastes, quickly deleted content, and posts on other platforms like Telegram also never appear in the Pastebin feed.

How do I avoid false positives from recycled combolists?▼

Deduplicate hits against prior findings and known breaches, since the same email:password pairs are reposted endlessly. Confirm a flagged credential is live and actually yours by matching the email domain and non-destructively testing keys against provider metadata endpoints.

Related Skills

Explore More Software Engineering Skills→
mykcsmykcs
1

lark-contact

Retrieve Feishu/Lark employee contact details and search by keywords.

Community
Intermediate
gfargogfargo

key-rotation

Rotate SSH keys, API keys, database passwords, and GitHub secrets across Strut VPS stacks.

Community
Advanced
taracodlabstaracodlabs
779

haveibeenpwned

Query the Have I Been Pwned v3 API to detect breached emails.

Official
Intermediate
Liberty91LTDLiberty91LTD
15

darkweb-collection

Collects and synthesizes dark web intelligence from surface-web sources into structured summaries.

Official
Intermediate