postmaniac - GitLite

KO | EN

gitlite — search

#javascript #typescript #llm #golang #android #rust #deep-learning #linux #docker #awesome #vue #ios #openai #open-source

postmaniac

(★ 168)

Postman OSINT tool to extract creds, token, username, email & more from Postman Public Workspaces

File Explorer

Download Latest Version (.zip)

- - bug_report.md
- - codeql.yml
  - python-publish.yml
- demo.gif
- long_banner.png
- __init__.py
- postmaniac.py
.gitignore
Dockerfile
LICENSE.md
pyproject.toml
README.md
requirements.txt
setup.py

# Installation Guide

1. Get the code

git clone https://github.com/boringthegod/postmaniac

Downloads the entire project code from GitHub to your computer.

cd postmaniac

Moves into the project folder you just downloaded.

2. Docker

Easy Recommended

Prerequisites

Git Needed to download the project code from GitHub.
Docker Desktop Needed to build and run containers. Install it and keep it running in the background.

docker pull ghcr.io/boringthegod/postmaniac:latest

Type this command into your terminal and run it.

✅ Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.

Pulled directly from this repo's README.

3. Python

Easy

Prerequisites

Git Needed to download the project code from GitHub.
Python 3 On Windows, be sure to check 'Add Python to PATH' during installation.

pip install -r requirements.txt

Installs the Python libraries listed in requirements.txt (or similar).

python <실행할 파일명>.py # README에서 정확한 실행 파일명을 확인하세요

Runs the Python script (or module).

✅ If it runs without errors and prints output in the terminal, it worked.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# postmaniac

![](https://raw.githubusercontent.com/boringthegod/postmaniac/master/assets/long_banner.png)

# Description

Postman OSINT tool to **extract creds, token, username, email & more from Postman Public Workspaces**.

It is designed to perform OSINT recognition on a target for pentesting, bugbounty and more, in order to get the maximum information from the requests left by developers on the Postman public workspaces.

Bonus:

- No need to be authenticated

- No API blocking / No rate-limit

# Requirements

[Python 3](https://www.python.org/download/releases/3.0/)

# Installation

### With PyPI

`pip3 install postmaniac`

### With Github

```bash
# clone the repo
$ git clone https://github.com/boringthegod/postmaniac.git

# change the working directory to postmaniac
$ cd postmaniac

# install postmaniac
$ python3 setup.py install
```

### With Docker

You can pull the Docker image with:

```bash
docker pull ghcr.io/boringthegod/postmaniac:latest
```

And then launch the tool **by not forgetting to specify your volume** to be able to read the file scan.txt written in output

`docker run -v scan:/output ghcr.io/boringthegod/postmaniac query`

# Usage

postmaniac can be run from the CLI and rapidly embedded within existing python applications.

```bash
usage: postmaniac [-h] query

Postman OSINT tool to extract creds, token, username, email & more from Postman Public Workspaces

positional arguments:
  query       name of the target (example: tesla)

options:
  -h, --help  show this help message and exit
```

All the interesting information (whether in the environment values of the Postman Workspace, or in authentication values, in the headers or directly in the body of each request) is retrieved and **written in the scan.txt file**

## Demo

![](https://github.com/boringthegod/postmaniac/blob/master/assets/demo.gif)

# Details

## Disclaimer

This tool is for educational purposes only, I am not responsible for its use.

## License

[GNU General Public License v3.0](https://www.gnu.org/licenses/gpl-3.0.fr.html)