Skip to content

Back to the catalog

MassPIIFinder v2
github.comrepo

MassPIIFinder v2

MassPIIFinder v2 is a Python recon tool that automates crawling a target's in-scope JavaScript (multi-hop HTML crawl, dynamic imports, chunk manifests, sourcemaps, plus optional passive CT-log subdomain discovery) and mines it for API keys, tokens, credentials, internal endpoints, and PII using ~90 named patterns plus a high-entropy freeform heuristic. Findings are validated offline (Luhn checks, JWT decode, AWS key-shape) and via scope-checked, rate-limited reachability probes, then triaged by severity and exported as JSON/HTML/SARIF/Markdown/CSV. It enforces authorization with a required --confirm-authorized flag and a ScopeGuard that blocks any out-of-scope requests, and explicitly avoids testing leaked keys against third-party providers or exploiting findings.

TL;DR A scope-enforced Python recon tool that crawls target JS to find and triage leaked secrets, tokens, endpoints, and PII for bug-bounty/pentest use.
Open original ↗
Document

What it is

MassPIIFinder v2 ships both a CLI (cli.py) and a Flask GUI (app.py, served on http://127.0.0.1:7331) with SQLite-backed scan history. The summary describes the pipeline; what it omits is how you actually drive the tool, the operational defaults, and its CI integration path.

What to do

Install and run:

pip install -r requirements.txt
python cli.py https://target.example.com --confirm-authorized

Useful flag combinations the page documents:

python cli.py https://target.example.com --confirm-authorized --json out.json --html out.html
python cli.py https://target.example.com --confirm-authorized --format sarif -o out.sarif
python cli.py https://target.example.com --confirm-authorized --min-severity HIGH
python cli.py https://target.example.com --confirm-authorized --no-probe
python cli.py https://target.example.com --confirm-authorized --scope api.example.com --scope "*.example-cdn.net"
python cli.py https://target.example.com --confirm-authorized --enumerate-subdomains
python cli.py https://target.example.com --confirm-authorized --rate-limit 4
python cli.py https://target.example.com --confirm-authorized --diff-against previous.json

Scope syntax accepts exact host, sub.example.com, or *.example.com wildcard. Subdomain discovery (--enumerate-subdomains) is passive-only via crt.sh CT logs — no brute force or port scanning. --no-probe skips live reachability checks entirely if you want a purely static pass.

CI wiring — the page gives two concrete recipes:

  • cli.py --format sarif -o out.sarif feeds GitHub code scanning.
  • --diff-against previous.json fails a build only on genuinely new findings, so a known-baseline of leaked-but-accepted secrets won't keep breaking the pipeline.

Operational defaults / limits

  • Target-facing requests are rate-limited to 8 req/s by default, tunable via --rate-limit.
  • robots.txt is honored during the HTML-crawl phase by default.
  • Every finding carries a multi-signal confidence score (pattern base confidence + entropy + offline structural check + noise-hint suppression) alongside its CRITICAL/HIGH/MEDIUM/LOW severity.

Caveats

Discovered provider keys (AWS, Stripe, Slack, GitHub, etc.) are flagged for manual verification, never tested against their providers — confirming real impact is a separate action needing its own authorization, and the tool only points you at the standard safe way to do it. Note also the README embeds a personal donation link (razorpay.me/@kanishkdadhich); this is an individual's project, not a vendored/maintained product, so weigh that before wiring it into a permanent pipeline.

Technologies named here

Techniques named here

  • JS-mining recon workflow
  • Passive subdomain discovery via CT logs
  • High-entropy string heuristic
  • Structural/offline secret validation
  • Scope-checked, rate-limited reachability probing
  • Multi-signal confidence scoring and severity triage
  • Scan-to-scan diffing

Related in OSINT