anjali-001 / attack-on-web

A CLI application to look for vulnerable API keys

Attack-on-Web(AoW)

AttackOn-Web is a CLI application that runs in your local system environment or in a CI environment to assist you with identifying 20 (More added soon) kinds of secret/API Keys, just as other potential security weaknesses or policy breaks.

AOW utilizes our local APIs to filter your code and identify expected secret/API Keys in your code. We won't store any records you are sending or any secret keys we have recognized.

• Test using CLI
• Test using GitHub Actions

Test using CLI

npm i atow
npx atow

npx is a package runner tool that comes with npm 5.2+ and higher.

Commands Usage: npx atow [OPTIONS]

Options:
    -h or  --help       to view list of commands
    -t or  --test       for testing.
    -l or  --list       for list of providers.

OUTPUT

If no secrets or policy breaks have been found, the exit code will be 0:

If a secret or other issue is found in your staged code or in your CI, you will have an alert giving you the type of policy break, the filename where the policy break has been found and a patch giving you the position of the policy break in the file:

✔ Read fileD:\MLH\dev-tools\attack-on-web\node_modules\yargs-parser\build\lib\yargs-parser.js
✔ Read fileD:\MLH\dev-tools\attack-on-web\src\check.js
✔ Read fileD:\MLH\dev-tools\attack-on-web\src\checkGitignoreRegex.js
✔ Read fileD:\MLH\dev-tools\attack-on-web\src\crawl.js
✖ Stripe API Key found in D:\MLH\dev-tools\attack-on-web\src\extensionChecker.js
2 const check = 'sk_live_4eC39HqLyjWDarjtT1zdp7dc'

Test using Github Actions

Input

repo-name

The name of the repository where you are calling this actions

Required This input is required for the action to run

Example usage

uses: felixfaisal/[email protected]
with:
  repo-name: 'my-repo'

Contributing

To contribute, please find the contribution guidelines here - Contribution Guidelines

License

MIT