README

➡️ Discord ⬅️
The easiest way to identify anything
pip3 install pywhat && pywhat --help



       



 🤔 What is this?

!

Imagine this: You come across some mysterious text 🧙‍♂️ 0x52908400098527886E0F7030069857D2E4169EE7 or dQw4w9WgXcQ and you wonder what it is. What do you do?

Well, with what all you have to do is ask what "0x52908400098527886E0F7030069857D2E4169EE7" and what will tell you!

what's job is to identify _what_ something is. Whether it be a file or text! Or even the hex of a file! What about text _within_ files? We have that too! what is recursive, it will identify everything in text and more!

 Installation

 🔨 Using pip

$ pip3 install pywhat

or

shell
 installs optional dependencies that may improve the speed
$ pip3 install pywhat[optimize] 


 🔨 On Mac?

$ brew install pywhat

Or for our MacPorts fans:

$ sudo port install pywhat

 ⚙ Use Cases

 🦠 Wannacry

!

You come across a new piece of malware called WantToCry. You think back to Wannacry and remember it was stopped because a researcher found a kill-switch in the code.

When a domain, hardcoded into Wannacry, was registered the virus would stop.

You use What to identify all the domains in the malware, and use a domain registrar API to register all the domains.

 🦈 Faster Analysis of Pcap files

!

Say you have a .pcap file from a network attack. What can identify this and quickly find you:

- All URLs
- Emails
- Phone numbers
- Credit card numbers
- Cryptocurrency addresses
- Social Security Numbers
- and much more.

With what, you can identify the important things in the pcap in seconds, not minutes.

 🐞 Bug Bounties

You can use PyWhat to scan for things that'll make you money via bug bounties like:
 API Keys
 Webhooks
 Credentials
 and more

Run PyWhat with:


pywhat --include "Bug Bounty" TEXT


To do this.

Here are some examples 👇

 🐙 GitHub Repository API Key Leaks

1. Download all GitHub repositories of an organisation
2. Search for anything that you can submit as a bounty, like API keys

shell
 Download all repositories
GHUSER=CHANGEME; curl "https://api.github.com/users/$GHUSER/repos?per_page=1000" | grep -o 'git@[^"]' | xargs -L1 git clone

 Will print when it finds things.
 Loops over all files in current directory.
find . -type f -execdir pywhat --include 'Bug Bounty' {} \;


 🕷 Scan all web pages for bounties

shell
 Recursively download all web pages of a site
wget -r -np -k https://skerritt.blog

 Will print when it finds things.
 Loops over all files in current directory.
find . -type f -execdir pywhat --include 'Bug Bounty' {} \;


PS: We support more filters than just bug bounties! Run pywhat --tags

 🌌 Other Features

Anytime you have a file and you want to find structured data in it that's useful, What is for you.

Or if you come across some piece of text and you don't know what it is, What will tell you.

 📁 File & Directory Handling

File Opening You can pass in a file path by what 'this/is/a/file/path'. What is smart enough to figure out it's a fi