Postman OSINT tool to extract creds, token, username, email & more from Postman Public Workspaces.
It is designed to perform OSINT recognition on a target for pentesting, bugbounty and more, in order to get the maximum information from the requests left by developers on the Postman public workspaces.
Bonus:
-
No need to be authenticated
-
No API blocking / No rate-limit
pip3 install postmaniac
# clone the repo
$ git clone https://github.com/boringthegod/postmaniac.git
# change the working directory to postmaniac
$ cd postmaniac
# install postmaniac
$ python3 setup.py installYou can pull the Docker image with:
docker pull ghcr.io/boringthegod/postmaniac:latestAnd then launch the tool by not forgetting to specify your volume to be able to read the file scan.txt written in output
docker run -v scan:/output ghcr.io/boringthegod/postmaniac query
postmaniac can be run from the CLI and rapidly embedded within existing python applications.
usage: postmaniac [-h] query
Postman OSINT tool to extract creds, token, username, email & more from Postman Public Workspaces
positional arguments:
query name of the target (example: tesla)
options:
-h, --help show this help message and exitAll the interesting information (whether in the environment values of the Postman Workspace, or in authentication values, in the headers or directly in the body of each request) is retrieved and written in the scan.txt file
This tool is for educational purposes only, I am not responsible for its use.