[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFZ6R3P2D5DGQZR06YBQ5Z":3,"skill-same:01M6AFZ6R3P2D5DGQZR06YBQ5Z":136},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":95,"commitSha":96,"skillDirectory":97,"forksCount":98,"repositoryHtmlUrl":99,"repositoryHomepageUrl":100,"ownerHtmlUrl":101,"ownerBlogUrl":102,"ownerDescription":103,"updatedAt":104,"install":105,"resources":118},"01M6AFZ6R3P2D5DGQZR06YBQ5Z","performing-paste-site-monitoring-for-credentials",null,"Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-paste-site-monitoring-for-credentials\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"performing paste site monitoring for credentials","monitoring","credentials","early-warning","data-breach","pastebin","credential-leak","paste-monitoring","api","initial-access","t1003","cybersecurity","reconnaissance","data","threat-intelligence","osint","search","development","monitor","customer","2026-11-10 10:12:30",false,"---\nname: performing-paste-site-monitoring-for-credentials\ndescription: Monitor paste sites like Pastebin and GitHub Gists for leaked credentials,\n  API keys, and sensitive data dumps using automated scraping and keyword matching\n  to detect breaches early.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- paste-monitoring\n- credential-leak\n- pastebin\n- data-breach\n- threat-intelligence\n- osint\n- early-warning\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - resource-development\n  - initial-access\n  techniques:\n  - id: T1593\n    name: Search Open Websites\u002FDomains\n    tactic: reconnaissance\n    source: attack\n  - id: T1593.002\n    name: 'Search Open Websites\u002FDomains: Search Engines'\n    tactic: reconnaissance\n    source: attack\n  - id: T1650\n    name: Acquire Access\n    tactic: resource-development\n    source: attack\n  - id: T1555.003\n    name: 'Credentials from Password Stores: Credentials from Web Browsers'\n    tactic: reconnaissance\n    source: attack\n  - id: T1110.004\n    name: 'Brute Force:  Credential Stuffing'\n    tactic: initial-access\n    source: attack\n  - id: F1029\n    name: Gather Customer Information\n    tactic: reconnaissance\n    source: f3\n---\n# Performing Paste Site Monitoring for Credentials\n\n## Overview\n\nPaste sites (Pastebin, GitHub Gists, Ghostbin, Dpaste, Hastebin) are frequently used as staging areas for leaked credentials, database dumps, API keys, and sensitive data before wider distribution on dark web forums and Telegram channels. Monitoring these sites provides early breach detection, enabling organizations to respond before stolen data is weaponized. This skill covers building automated paste site monitors using the Pastebin Scraping API, keyword-based alerting, credential pattern matching, and integration with incident response workflows.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing paste site monitoring for credentials\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `beautifulsoup4`, `regex`, `pymisp` libraries\n- Pastebin PRO account with Scraping API access ($49.95\u002Fmonth for programmatic access)\n- GitHub API token for Gist monitoring\n- Keyword lists specific to your organization (domains, project names, internal terms)\n- Elasticsearch or database for paste storage and search\n\n## Key Concepts\n\n### Paste Site Threat Landscape\n\nOver 300,000 user credentials are posted on Pastebin annually, averaging 1,000 username\u002Fpassword pairs per leak. Paste sites serve three primary threat intelligence purposes: early breach detection (credentials appear on paste sites before dark web), threat actor profiling (actors use paste sites for C2 configuration, data staging, tool sharing), and malware discovery (encoded payloads, configuration files, C2 addresses).\n\n### Monitoring Approaches\n\nActive monitoring queries paste site APIs or scraping endpoints at regular intervals. The Pastebin Scraping API provides real-time access to new public pastes. For GitHub, the search API allows monitoring Gists and repository commits for exposed secrets. Passive monitoring uses services like IntelX, Dehashed, or Have I Been Pwned that aggregate paste site data.\n\n### Credential Pattern Detection\n\nEffective monitoring uses regex patterns for email:password combinations, API keys (AWS, Azure, GCP, Stripe, Twilio), database connection strings, private keys (SSH, PGP), JWT tokens, and internal hostnames\u002FURLs. Organization-specific keywords (domain names, product names, employee names) reduce false positives.\n\n## Workflow\n\n### Step 1: Pastebin Scraping API Monitor\n\n```python\nimport requests\nimport re\nimport json\nimport time\nfrom datetime import datetime\n\nclass PastebinMonitor:\n    SCRAPING_URL = \"https:\u002F\u002Fscrape.pastebin.com\u002Fapi_scraping.php\"\n    RAW_URL = \"https:\u002F\u002Fscrape.pastebin.com\u002Fapi_scrape_item.php\"\n\n    def __init__(self, keywords, output_dir=\"paste_alerts\"):\n        self.keywords = [k.lower() for k in keywords]\n        self.output_dir = output_dir\n        self.seen_keys = set()\n        self.credential_patterns = {\n            \"email_password\": re.compile(\n                r'[\\w.+-]+@[\\w-]+\\.[\\w.]+[\\s:;|,]+[\\S]{6,}', re.IGNORECASE),\n            \"aws_key\": re.compile(\n                r'AKIA[0-9A-Z]{16}'),\n            \"aws_secret\": re.compile(\n                r'[0-9a-zA-Z\u002F+=]{40}'),\n            \"github_token\": re.compile(\n                r'ghp_[0-9a-zA-Z]{36}'),\n            \"slack_token\": re.compile(\n                r'xox[baprs]-[0-9a-zA-Z-]+'),\n            \"private_key\": re.compile(\n                r'-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----'),\n            \"jwt_token\": re.compile(\n                r'eyJ[A-Za-z0-9-_]+\\.eyJ[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+'),\n            \"connection_string\": re.compile(\n                r'(?:mongodb|postgres|mysql|redis):\u002F\u002F[^\\s]+'),\n            \"api_key_generic\": re.compile(\n                r'(?:api[_-]?key|apikey|access[_-]?token)[\\s]*[=:]\\s*[\"\\']?[\\w-]{20,}',\n                re.IGNORECASE),\n        }\n\n    def fetch_recent_pastes(self, limit=100):\n        \"\"\"Fetch recent public pastes from Pastebin Scraping API.\"\"\"\n        params = {\"limit\": limit}\n        try:\n            resp = requests.get(self.SCRAPING_URL, params=params, timeout=30)\n            if resp.status_code == 200:\n                pastes = resp.json()\n                print(f\"[+] Fetched {len(pastes)} recent pastes\")\n                return pastes\n            else:\n                print(f\"[-] API error: {resp.status_code}\")\n                return []\n        except Exception as e:\n            print(f\"[-] Fetch error: {e}\")\n            return []\n\n    def get_paste_content(self, paste_key):\n        \"\"\"Get the raw content of a paste.\"\"\"\n        params = {\"i\": paste_key}\n        try:\n            resp = requests.get(self.RAW_URL, params=params, timeout=15)\n            if resp.status_code == 200:\n                return resp.text\n            return \"\"\n        except Exception:\n            return \"\"\n\n    def analyze_paste(self, content, paste_metadata):\n        \"\"\"Analyze paste content for credentials and keywords.\"\"\"\n        findings = {\n            \"keyword_matches\": [],\n            \"credential_matches\": {},\n            \"severity\": \"low\",\n        }\n\n        content_lower = content.lower()\n\n        # Check keywords\n        for keyword in self.keywords:\n            if keyword in content_lower:\n                count = content_lower.count(keyword)\n                findings[\"keyword_matches\"].append({\n                    \"keyword\": keyword,\n                    \"count\": count,\n                })\n\n        # Check credential patterns\n        for pattern_name, pattern in self.credential_patterns.items():\n            matches = pattern.findall(content)\n            if matches:\n                findings[\"credential_matches\"][pattern_name] = {\n                    \"count\": len(matches),\n                    \"samples\": matches[:3],\n                }\n\n        # Calculate severity\n        cred_count = sum(\n            m[\"count\"] for m in findings[\"credential_matches\"].values()\n        )\n        if findings[\"keyword_matches\"] and cred_count > 0:\n            findings[\"severity\"] = \"critical\"\n        elif findings[\"keyword_matches\"]:\n            findings[\"severity\"] = \"high\"\n        elif cred_count > 10:\n            findings[\"severity\"] = \"high\"\n        elif cred_count > 0:\n            findings[\"severity\"] = \"medium\"\n\n        return findings\n\n    def monitor_loop(self, interval=120, iterations=None):\n        \"\"\"Continuous monitoring loop.\"\"\"\n        count = 0\n        while iterations is None or count \u003C iterations:\n            pastes = self.fetch_recent_pastes()\n            alerts = []\n\n            for paste in pastes:\n                paste_key = paste.get(\"key\", \"\")\n                if paste_key in self.seen_keys:\n                    continue\n                self.seen_keys.add(paste_key)\n\n                content = self.get_paste_content(paste_key)\n                if not content:\n                    continue\n\n                findings = self.analyze_paste(content, paste)\n                if findings[\"severity\"] != \"low\":\n                    alert = {\n                        \"paste_key\": paste_key,\n                        \"title\": paste.get(\"title\", \"Untitled\"),\n                        \"user\": paste.get(\"user\", \"Anonymous\"),\n                        \"date\": paste.get(\"date\", \"\"),\n                        \"size\": paste.get(\"size\", 0),\n                        \"url\": f\"https:\u002F\u002Fpastebin.com\u002F{paste_key}\",\n                        \"findings\": findings,\n                        \"detected_at\": datetime.now().isoformat(),\n                    }\n                    alerts.append(alert)\n                    print(f\"  [ALERT-{findings['severity'].upper()}] \"\n                          f\"{paste_key}: {findings['keyword_matches']}\")\n\n            if alerts:\n                self._save_alerts(alerts)\n\n            count += 1\n            if iterations is None or count \u003C iterations:\n                time.sleep(interval)\n\n        return alerts\n\n    def _save_alerts(self, alerts):\n        \"\"\"Save alerts to JSON file.\"\"\"\n        filename = f\"{self.output_dir}\u002Falerts_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json\"\n        import os\n        os.makedirs(self.output_dir, exist_ok=True)\n        with open(filename, \"w\") as f:\n            json.dump(alerts, f, indent=2)\n        print(f\"[+] Saved {len(alerts)} alerts to {filename}\")\n\nmonitor = PastebinMonitor(\n    keywords=[\"mycompany.com\", \"internal-project\", \"employee-name\"],\n)\nalerts = monitor.monitor_loop(interval=120, iterations=5)\n```\n\n### Step 2: GitHub Gist and Code Search Monitoring\n\n```python\nclass GitHubSecretMonitor:\n    def __init__(self, github_token, org_keywords):\n        self.token = github_token\n        self.keywords = org_keywords\n        self.headers = {\n            \"Authorization\": f\"token {github_token}\",\n            \"Accept\": \"application\u002Fvnd.github.v3+json\",\n        }\n\n    def search_code(self, query, per_page=30):\n        \"\"\"Search GitHub code for leaked secrets.\"\"\"\n        url = \"https:\u002F\u002Fapi.github.com\u002Fsearch\u002Fcode\"\n        params = {\"q\": query, \"per_page\": per_page}\n        resp = requests.get(url, headers=self.headers, params=params)\n        if resp.status_code == 200:\n            results = resp.json().get(\"items\", [])\n            print(f\"[+] GitHub code search: {len(results)} results for '{query}'\")\n            return results\n        return []\n\n    def search_gists(self, keyword):\n        \"\"\"Search public Gists for sensitive data.\"\"\"\n        url = \"https:\u002F\u002Fapi.github.com\u002Fgists\u002Fpublic\"\n        params = {\"per_page\": 100}\n        resp = requests.get(url, headers=self.headers, params=params)\n        matches = []\n        if resp.status_code == 200:\n            gists = resp.json()\n            for gist in gists:\n                description = (gist.get(\"description\") or \"\").lower()\n                files = gist.get(\"files\", {})\n                for filename, file_info in files.items():\n                    if keyword.lower() in description or keyword.lower() in filename.lower():\n                        matches.append({\n                            \"gist_id\": gist[\"id\"],\n                            \"description\": gist.get(\"description\", \"\"),\n                            \"filename\": filename,\n                            \"url\": gist[\"html_url\"],\n                            \"created_at\": gist[\"created_at\"],\n                        })\n        return matches\n\n    def monitor_org_secrets(self, org_domain):\n        \"\"\"Monitor for organization secrets leaked on GitHub.\"\"\"\n        queries = [\n            f'\"{org_domain}\" password',\n            f'\"{org_domain}\" api_key',\n            f'\"{org_domain}\" secret',\n            f'\"{org_domain}\" token',\n            f'\"{org_domain}\" credentials',\n        ]\n        all_findings = []\n        for query in queries:\n            results = self.search_code(query)\n            for result in results:\n                all_findings.append({\n                    \"query\": query,\n                    \"repo\": result.get(\"repository\", {}).get(\"full_name\", \"\"),\n                    \"path\": result.get(\"path\", \"\"),\n                    \"url\": result.get(\"html_url\", \"\"),\n                    \"score\": result.get(\"score\", 0),\n                })\n            time.sleep(10)  # GitHub rate limiting\n        return all_findings\n\ngh_monitor = GitHubSecretMonitor(\"YOUR_GITHUB_TOKEN\", [\"mycompany.com\"])\nfindings = gh_monitor.monitor_org_secrets(\"mycompany.com\")\n```\n\n### Step 3: Alert and Incident Response Integration\n\n```python\ndef generate_credential_leak_alert(alert_data):\n    \"\"\"Generate incident alert for credential leak detection.\"\"\"\n    alert = {\n        \"title\": f\"Credential Leak Detected - {alert_data.get('severity', 'unknown').upper()}\",\n        \"source\": alert_data.get(\"url\", \"\"),\n        \"detected_at\": alert_data.get(\"detected_at\", \"\"),\n        \"severity\": alert_data.get(\"severity\", \"medium\"),\n        \"summary\": f\"Paste containing organization keywords and credentials found\",\n        \"keyword_matches\": alert_data.get(\"findings\", {}).get(\"keyword_matches\", []),\n        \"credential_types\": list(alert_data.get(\"findings\", {}).get(\"credential_matches\", {}).keys()),\n        \"recommended_actions\": [\n            \"Verify if leaked credentials are valid\",\n            \"Force password reset for affected accounts\",\n            \"Rotate exposed API keys and tokens\",\n            \"Check access logs for unauthorized usage\",\n            \"Report paste for takedown\",\n            \"Update monitoring keywords if new patterns found\",\n        ],\n    }\n    return alert\n```\n\n## Validation Criteria\n\n- Pastebin Scraping API queried successfully with rate limiting\n- Credential patterns detected (email:password, API keys, private keys)\n- Organization-specific keywords matched with context\n- GitHub code search identifies exposed secrets\n- Alerts generated with severity classification\n- Integration with incident response workflow\n\n## References\n\n- [Authentic8: Pastebin for CTI Research](https:\u002F\u002Fwww.authentic8.com\u002Fblog\u002Fwhat-is-pastebin-cyberthreat-intelligence)\n- [PasteHunter GitHub](https:\u002F\u002Fgithub.com\u002Fdibsy\u002Fpastehunter)\n- [Scavenger Credential Crawler](https:\u002F\u002Fgithub.com\u002Frndinfosecguy\u002FScavenger)\n- [Bitdefender: Credentials on Pastebin](https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fblog\u002Fhotforsecurity\u002Fmore-than-300000-user-credentials-posted-on-pastebin-over-the-last-year)\n- [zSecurity: Pastebin Monitoring](https:\u002F\u002Fzsecurity.org\u002Fglossary\u002Fpastebin-monitoring\u002F)\n- [SecurityBoulevard: Need to Monitor Paste Sites](https:\u002F\u002Fsecurityboulevard.com\u002F2019\u002F11\u002Forvis-data-leak-and-the-need-to-monitor-paste-sites\u002F)\n","# Performing Paste Site Monitoring for Credentials\n\n## Overview\n\nPaste sites (Pastebin, GitHub Gists, Ghostbin, Dpaste, Hastebin) are frequently used as staging areas for leaked credentials, database dumps, API keys, and sensitive data before wider distribution on dark web forums and Telegram channels. Monitoring these sites provides early breach detection, enabling organizations to respond before stolen data is weaponized. This skill covers building automated paste site monitors using the Pastebin Scraping API, keyword-based alerting, credential pattern matching, and integration with incident response workflows.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing paste site monitoring for credentials\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `beautifulsoup4`, `regex`, `pymisp` libraries\n- Pastebin PRO account with Scraping API access ($49.95\u002Fmonth for programmatic access)\n- GitHub API token for Gist monitoring\n- Keyword lists specific to your organization (domains, project names, internal terms)\n- Elasticsearch or database for paste storage and search\n\n## Key Concepts\n\n### Paste Site Threat Landscape\n\nOver 300,000 user credentials are posted on Pastebin annually, averaging 1,000 username\u002Fpassword pairs per leak. Paste sites serve three primary threat intelligence purposes: early breach detection (credentials appear on paste sites before dark web), threat actor profiling (actors use paste sites for C2 configuration, data staging, tool sharing), and malware discovery (encoded payloads, configuration files, C2 addresses).\n\n### Monitoring Approaches\n\nActive monitoring queries paste site APIs or scraping endpoints at regular intervals. The Pastebin Scraping API provides real-time access to new public pastes. For GitHub, the search API allows monitoring Gists and repository commits for exposed secrets. Passive monitoring uses services like IntelX, Dehashed, or Have I Been Pwned that aggregate paste site data.\n\n### Credential Pattern Detection\n\nEffective monitoring uses regex patterns for email:password combinations, API keys (AWS, Azure, GCP, Stripe, Twilio), database connection strings, private keys (SSH, PGP), JWT tokens, and internal hostnames\u002FURLs. Organization-specific keywords (domain names, product names, employee names) reduce false positives.\n\n## Workflow\n\n### Step 1: Pastebin Scraping API Monitor\n\n```python\nimport requests\nimport re\nimport json\nimport time\nfrom datetime import datetime\n\nclass PastebinMonitor:\n    SCRAPING_URL = \"https:\u002F\u002Fscrape.pastebin.com\u002Fapi_scraping.php\"\n    RAW_URL = \"https:\u002F\u002Fscrape.pastebin.com\u002Fapi_scrape_item.php\"\n\n    def __init__(self, keywords, output_dir=\"paste_alerts\"):\n        self.keywords = [k.lower() for k in keywords]\n        self.output_dir = output_dir\n        self.seen_keys = set()\n        self.credential_patterns = {\n            \"email_password\": re.compile(\n                r'[\\w.+-]+@[\\w-]+\\.[\\w.]+[\\s:;|,]+[\\S]{6,}', re.IGNORECASE),\n            \"aws_key\": re.compile(\n                r'AKIA[0-9A-Z]{16}'),\n            \"aws_secret\": re.compile(\n                r'[0-9a-zA-Z\u002F+=]{40}'),\n            \"github_token\": re.compile(\n                r'ghp_[0-9a-zA-Z]{36}'),\n            \"slack_token\": re.compile(\n                r'xox[baprs]-[0-9a-zA-Z-]+'),\n            \"private_key\": re.compile(\n                r'-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----'),\n            \"jwt_token\": re.compile(\n                r'eyJ[A-Za-z0-9-_]+\\.eyJ[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+'),\n            \"connection_string\": re.compile(\n                r'(?:mongodb|postgres|mysql|redis):\u002F\u002F[^\\s]+'),\n            \"api_key_generic\": re.compile(\n                r'(?:api[_-]?key|apikey|access[_-]?token)[\\s]*[=:]\\s*[\"\\']?[\\w-]{20,}',\n                re.IGNORECASE),\n        }\n\n    def fetch_recent_pastes(self, limit=100):\n        \"\"\"Fetch recent public pastes from Pastebin Scraping API.\"\"\"\n        params = {\"limit\": limit}\n        try:\n            resp = requests.get(self.SCRAPING_URL, params=params, timeout=30)\n            if resp.status_code == 200:\n                pastes = resp.json()\n                print(f\"[+] Fetched {len(pastes)} recent pastes\")\n                return pastes\n            else:\n                print(f\"[-] API error: {resp.status_code}\")\n                return []\n        except Exception as e:\n            print(f\"[-] Fetch error: {e}\")\n            return []\n\n    def get_paste_content(self, paste_key):\n        \"\"\"Get the raw content of a paste.\"\"\"\n        params = {\"i\": paste_key}\n        try:\n            resp = requests.get(self.RAW_URL, params=params, timeout=15)\n            if resp.status_code == 200:\n                return resp.text\n            return \"\"\n        except Exception:\n            return \"\"\n\n    def analyze_paste(self, content, paste_metadata):\n        \"\"\"Analyze paste content for credentials and keywords.\"\"\"\n        findings = {\n            \"keyword_matches\": [],\n            \"credential_matches\": {},\n            \"severity\": \"low\",\n        }\n\n        content_lower = content.lower()\n\n        # Check keywords\n        for keyword in self.keywords:\n            if keyword in content_lower:\n                count = content_lower.count(keyword)\n                findings[\"keyword_matches\"].append({\n                    \"keyword\": keyword,\n                    \"count\": count,\n                })\n\n        # Check credential patterns\n        for pattern_name, pattern in self.credential_patterns.items():\n            matches = pattern.findall(content)\n            if matches:\n                findings[\"credential_matches\"][pattern_name] = {\n                    \"count\": len(matches),\n                    \"samples\": matches[:3],\n                }\n\n        # Calculate severity\n        cred_count = sum(\n            m[\"count\"] for m in findings[\"credential_matches\"].values()\n        )\n        if findings[\"keyword_matches\"] and cred_count > 0:\n            findings[\"severity\"] = \"critical\"\n        elif findings[\"keyword_matches\"]:\n            findings[\"severity\"] = \"high\"\n        elif cred_count > 10:\n            findings[\"severity\"] = \"high\"\n        elif cred_count > 0:\n            findings[\"severity\"] = \"medium\"\n\n        return findings\n\n    def monitor_loop(self, interval=120, iterations=None):\n        \"\"\"Continuous monitoring loop.\"\"\"\n        count = 0\n        while iterations is None or count \u003C iterations:\n            pastes = self.fetch_recent_pastes()\n            alerts = []\n\n            for paste in pastes:\n                paste_key = paste.get(\"key\", \"\")\n                if paste_key in self.seen_keys:\n                    continue\n                self.seen_keys.add(paste_key)\n\n                content = self.get_paste_content(paste_key)\n                if not content:\n                    continue\n\n                findings = self.analyze_paste(content, paste)\n                if findings[\"severity\"] != \"low\":\n                    alert = {\n                        \"paste_key\": paste_key,\n                        \"title\": paste.get(\"title\", \"Untitled\"),\n                        \"user\": paste.get(\"user\", \"Anonymous\"),\n                        \"date\": paste.get(\"date\", \"\"),\n                        \"size\": paste.get(\"size\", 0),\n                        \"url\": f\"https:\u002F\u002Fpastebin.com\u002F{paste_key}\",\n                        \"findings\": findings,\n                        \"detected_at\": datetime.now().isoformat(),\n                    }\n                    alerts.append(alert)\n                    print(f\"  [ALERT-{findings['severity'].upper()}] \"\n                          f\"{paste_key}: {findings['keyword_matches']}\")\n\n            if alerts:\n                self._save_alerts(alerts)\n\n            count += 1\n            if iterations is None or count \u003C iterations:\n                time.sleep(interval)\n\n        return alerts\n\n    def _save_alerts(self, alerts):\n        \"\"\"Save alerts to JSON file.\"\"\"\n        filename = f\"{self.output_dir}\u002Falerts_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json\"\n        import os\n        os.makedirs(self.output_dir, exist_ok=True)\n        with open(filename, \"w\") as f:\n            json.dump(alerts, f, indent=2)\n        print(f\"[+] Saved {len(alerts)} alerts to {filename}\")\n\nmonitor = PastebinMonitor(\n    keywords=[\"mycompany.com\", \"internal-project\", \"employee-name\"],\n)\nalerts = monitor.monitor_loop(interval=120, iterations=5)\n```\n\n### Step 2: GitHub Gist and Code Search Monitoring\n\n```python\nclass GitHubSecretMonitor:\n    def __init__(self, github_token, org_keywords):\n        self.token = github_token\n        self.keywords = org_keywords\n        self.headers = {\n            \"Authorization\": f\"token {github_token}\",\n            \"Accept\": \"application\u002Fvnd.github.v3+json\",\n        }\n\n    def search_code(self, query, per_page=30):\n        \"\"\"Search GitHub code for leaked secrets.\"\"\"\n        url = \"https:\u002F\u002Fapi.github.com\u002Fsearch\u002Fcode\"\n        params = {\"q\": query, \"per_page\": per_page}\n        resp = requests.get(url, headers=self.headers, params=params)\n        if resp.status_code == 200:\n            results = resp.json().get(\"items\", [])\n            print(f\"[+] GitHub code search: {len(results)} results for '{query}'\")\n            return results\n        return []\n\n    def search_gists(self, keyword):\n        \"\"\"Search public Gists for sensitive data.\"\"\"\n        url = \"https:\u002F\u002Fapi.github.com\u002Fgists\u002Fpublic\"\n        params = {\"per_page\": 100}\n        resp = requests.get(url, headers=self.headers, params=params)\n        matches = []\n        if resp.status_code == 200:\n            gists = resp.json()\n            for gist in gists:\n                description = (gist.get(\"description\") or \"\").lower()\n                files = gist.get(\"files\", {})\n                for filename, file_info in files.items():\n                    if keyword.lower() in description or keyword.lower() in filename.lower():\n                        matches.append({\n                            \"gist_id\": gist[\"id\"],\n                            \"description\": gist.get(\"description\", \"\"),\n                            \"filename\": filename,\n                            \"url\": gist[\"html_url\"],\n                            \"created_at\": gist[\"created_at\"],\n                        })\n        return matches\n\n    def monitor_org_secrets(self, org_domain):\n        \"\"\"Monitor for organization secrets leaked on GitHub.\"\"\"\n        queries = [\n            f'\"{org_domain}\" password',\n            f'\"{org_domain}\" api_key',\n            f'\"{org_domain}\" secret',\n            f'\"{org_domain}\" token',\n            f'\"{org_domain}\" credentials',\n        ]\n        all_findings = []\n        for query in queries:\n            results = self.search_code(query)\n            for result in results:\n                all_findings.append({\n                    \"query\": query,\n                    \"repo\": result.get(\"repository\", {}).get(\"full_name\", \"\"),\n                    \"path\": result.get(\"path\", \"\"),\n                    \"url\": result.get(\"html_url\", \"\"),\n                    \"score\": result.get(\"score\", 0),\n                })\n            time.sleep(10)  # GitHub rate limiting\n        return all_findings\n\ngh_monitor = GitHubSecretMonitor(\"YOUR_GITHUB_TOKEN\", [\"mycompany.com\"])\nfindings = gh_monitor.monitor_org_secrets(\"mycompany.com\")\n```\n\n### Step 3: Alert and Incident Response Integration\n\n```python\ndef generate_credential_leak_alert(alert_data):\n    \"\"\"Generate incident alert for credential leak detection.\"\"\"\n    alert = {\n        \"title\": f\"Credential Leak Detected - {alert_data.get('severity', 'unknown').upper()}\",\n        \"source\": alert_data.get(\"url\", \"\"),\n        \"detected_at\": alert_data.get(\"detected_at\", \"\"),\n        \"severity\": alert_data.get(\"severity\", \"medium\"),\n        \"summary\": f\"Paste containing organization keywords and credentials found\",\n        \"keyword_matches\": alert_data.get(\"findings\", {}).get(\"keyword_matches\", []),\n        \"credential_types\": list(alert_data.get(\"findings\", {}).get(\"credential_matches\", {}).keys()),\n        \"recommended_actions\": [\n            \"Verify if leaked credentials are valid\",\n            \"Force password reset for affected accounts\",\n            \"Rotate exposed API keys and tokens\",\n            \"Check access logs for unauthorized usage\",\n            \"Report paste for takedown\",\n            \"Update monitoring keywords if new patterns found\",\n        ],\n    }\n    return alert\n```\n\n## Validation Criteria\n\n- Pastebin Scraping API queried successfully with rate limiting\n- Credential patterns detected (email:password, API keys, private keys)\n- Organization-specific keywords matched with context\n- GitHub code search identifies exposed secrets\n- Alerts generated with severity classification\n- Integration with incident response workflow\n\n## References\n\n- [Authentic8: Pastebin for CTI Research](https:\u002F\u002Fwww.authentic8.com\u002Fblog\u002Fwhat-is-pastebin-cyberthreat-intelligence)\n- [PasteHunter GitHub](https:\u002F\u002Fgithub.com\u002Fdibsy\u002Fpastehunter)\n- [Scavenger Credential Crawler](https:\u002F\u002Fgithub.com\u002Frndinfosecguy\u002FScavenger)\n- [Bitdefender: Credentials on Pastebin](https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fblog\u002Fhotforsecurity\u002Fmore-than-300000-user-credentials-posted-on-pastebin-over-the-last-year)\n- [zSecurity: Pastebin Monitoring](https:\u002F\u002Fzsecurity.org\u002Fglossary\u002Fpastebin-monitoring\u002F)\n- [SecurityBoulevard: Need to Monitor Paste Sites](https:\u002F\u002Fsecurityboulevard.com\u002F2019\u002F11\u002Forvis-data-leak-and-the-need-to-monitor-paste-sites\u002F)\n",{"name":5,"tags":57,"author":58,"domain":43,"license":15,"version":59,"mitre_f3":60,"nist_csf":85,"subdomain":46,"description":7,"mitre_attack":90},[39,38,37,36,46,47,35],"mahipal","1.0",{"tactics":61,"version":63,"techniques":64},[44,62,41],"resource-development","1.1",[65,69,72,75,78,81],{"id":66,"name":67,"source":68,"tactic":44},"T1593","Search Open Websites\u002FDomains","attack",{"id":70,"name":71,"source":68,"tactic":44},"T1593.002","Search Open Websites\u002FDomains: Search Engines",{"id":73,"name":74,"source":68,"tactic":62},"T1650","Acquire Access",{"id":76,"name":77,"source":68,"tactic":44},"T1555.003","Credentials from Password Stores: Credentials from Web Browsers",{"id":79,"name":80,"source":68,"tactic":41},"T1110.004","Brute Force:  Credential Stuffing",{"id":82,"name":83,"source":84,"tactic":44},"F1029","Gather Customer Information","f3",[86,87,88,89],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[91,92,66,93,94],"T1591","T1592","T1589","T1003","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-paste-site-monitoring-for-credentials",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":106,"prompt":116,"zipAvailable":117},[107,110,113],{"tool":108,"command":109},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-paste-site-monitoring-for-credentials",{"tool":111,"command":112},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-paste-site-monitoring-for-credentials",{"tool":114,"command":115},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-paste-site-monitoring-for-credentials","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-paste-site-monitoring-for-credentials\u002FSKILL.md",true,[119,124,130],{"path":120,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-paste-site-monitoring-for-credentials\u002FLICENSE",{"path":125,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fapi-reference.md","REFERENCE","参考文档",1470,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-paste-site-monitoring-for-credentials\u002Freferences\u002Fapi-reference.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fagent.py","SCRIPT","脚本",7138,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-paste-site-monitoring-for-credentials\u002Fscripts\u002Fagent.py",[137,164,188,216,241,267],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[143],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[145,146,147,148,149,43,150,151,152,153,154,155,156,157,158,159,160,161,162,163],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":171,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[170],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[172,160,173,174,149,175,43,152,176,177,178,179,180,181,182,183,184,185,186,187],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":198,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[194,197],{"categoryNo":195,"categoryName":196,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[182,199,200,201,202,43,203,204,176,205,206,207,208,209,210,211,212,213,214,215],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[222],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,43,227,228,229,230,231,232,233,45,234,235,236,237,179,238,239,240],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":248,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[247],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[249,250,251,43,252,253,254,255,256,257,258,259,260,261,262,263,40,264,265,266],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","prioritization","ssvc","decision-tree",{"skillNo":268,"name":269,"nameZh":6,"description":270,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":271,"categories":272,"keywords":274,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[273],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[149,275,43,276,277,278,279,280,281,282,283,211,284,212,285,286,287,288,289,290],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]