MindSeeker Suite

███╗   ███╗██╗███╗   ██╗██████╗ ███████╗███████╗███████╗██╗  ██╗███████╗██████╗
████╗ ████║██║████╗  ██║██╔══██╗██╔════╝██╔════╝██╔════╝██║ ██╔╝██╔════╝██╔══██╗
██╔████╔██║██║██╔██╗ ██║██║  ██║███████╗█████╗  █████╗  █████╔╝ █████╗  ██████╔╝
██║╚██╔╝██║██║██║╚██╗██║██║  ██║╚════██║██╔══╝  ██╔══╝  ██╔═██╗ ██╔══╝  ██╔══██╗
██║ ╚═╝ ██║██║██║ ╚████║██████╔╝███████║███████╗███████╗██║  ██╗███████╗██║  ██║
╚═╝     ╚═╝╚═╝╚═╝  ╚═══╝╚═════╝ ╚══════╝╚══════╝╚══════╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝

Advanced GitHub OSINT & Secret Scanning Suite for Security Research

A comprehensive toolkit for defensive security research consisting of two powerful tools:

• Mind_Finder: GitHub employee discovery and reconnaissance
• Mind_Scanner: Repository secret scanning with TruffleHog, Gitleaks, and custom patterns

⚠️ Legal Disclaimer

FOR DEFENSIVE SECURITY RESEARCH ONLY

This toolkit is designed for authorized security research, bug bounty programs, and defensive security operations. Users must:

• Have explicit authorization before scanning any organization
• Comply with bug bounty program scope and rules
• Follow responsible disclosure practices
• Respect GitHub's Terms of Service and API rate limits
• Only use for defensive security purposes

Unauthorized access to computer systems is illegal. Misuse of these tools may violate laws including the Computer Fraud and Abuse Act (CFAA) and similar legislation worldwide.

🚀 Features

Mind_Finder - GitHub Employee Discovery

• 8 Discovery Methods: Comprehensive employee identification
  • Official organization members
  • Profile bio/company field search
  • Repository contributors analysis
  • Commit email discovery
  • Advanced pattern matching
  • GitHub dorking
  • Fork analysis
  • Package maintainer identification
• Confidence Scoring: Ranked results from 0-100%
• Export Formats: JSON results + username lists
• API Optimization: Smart rate limiting and caching

Mind_Scanner - Secret Scanner

• Multiple Scanning Engines:
  • TruffleHog (full git history)
  • Gitleaks (optional)
  • Custom regex patterns
• Custom Pattern Support: Company-specific secret detection
• Risk Scoring: Automatic classification (HIGH/MEDIUM/LOW)
• Comprehensive Reporting: JSON + human-readable outputs
• Smart Repository Management: Keeps findings, removes clean repos
• Commit-Level Attribution: Direct links to exposed secrets

📋 Requirements

System Requirements

• Python 3.8+
• Git
• 4GB+ RAM (for large scans)
• Linux/macOS/WSL2

Required Tools

# TruffleHog
pip3 install trufflehog

# jq (for JSON processing)
sudo apt install jq  # Debian/Ubuntu
brew install jq      # macOS

Optional Tools

# Gitleaks (optional but recommended)
# https://github.com/zricethezav/gitleaks
brew install gitleaks  # macOS
# or download from GitHub releases

🔧 Installation

# Clone the repository
git clone https://github.com/YOUR_USERNAME/MindSeeker_Suite.git
cd MindSeeker_Suite

# Install Python dependencies
pip3 install -r requirements.txt

# Set GitHub token (highly recommended)
export GITHUB_TOKEN=ghp_your_token_here

# Make scripts executable
chmod +x Mind_Finder.py Mind_Scanner.py

📖 Usage

Mind_Finder - Employee Discovery

Basic Usage:

python3 Mind_Finder.py -c <company_name> -d <company_domain>

Examples:

# Find employees for a company
python3 Mind_Finder.py -c Slack -d slack.com

# Find employees for Microsoft
python3 Mind_Finder.py -c Microsoft -d microsoft.com

Output:

• employee_discovery_<company>_<timestamp>.json - Full results with confidence scores
• usernames_<company>.txt - Username list for Mind_Scanner

Mind_Scanner - Secret Scanning

Auto Mode (auto-discover employees):

python3 Mind_Scanner.py -c <company> -d <domain> --auto

Manual Mode (use existing username list):

python3 Mind_Scanner.py -c <company> -d <domain> --manual usernames.txt

With Custom Patterns:

python3 Mind_Scanner.py -c Adobe -d adobe.com --manual users.txt -p examples/patterns/adobe_patterns.json

Complete Workflow:

# Step 1: Find employees
python3 Mind_Finder.py -c Slack -d slack.com

# Step 2: Scan their repositories
python3 Mind_Scanner.py -c Slack -d slack.com --manual usernames_Slack.txt

🎯 Custom Pattern Files

Create company-specific pattern files in JSON format:

{
  "api_keys": [
    "company_api_key['\"]?\\s*[:=]\\s*['\"]?([a-zA-Z0-9]{32,})",
    "x-api-key['\"]?\\s*[:=]\\s*['\"]?([a-zA-Z0-9]{32,})"
  ],
  "internal_domains": [
    ".*\\.company\\.com",
    ".*\\.company\\.internal"
  ],
  "aws_resources": [
    "arn:aws:[^:]+:[^:]*:[^:]*:.*company.*",
    "s3://[a-z0-9\\-]*company[a-z0-9\\-]*"
  ]
}

Example patterns are provided in examples/patterns/.

📊 Output Structure

Mind_Finder Output

employee_discovery_<company>_<timestamp>.json
  ├─ confirmed_employees    (90-100% confidence)
  ├─ probable_employees     (70-89% confidence)
  ├─ possible_employees     (50-69% confidence)
  └─ statistics

usernames_<company>.txt   (for Mind_Scanner input)

Mind_Scanner Output

github_hunt_<company>_<timestamp>/
  ├─ reports/
  │   ├─ SUMMARY.json
  │   ├─ HIGH_RISK_FINDINGS.json
  │   ├─ MEDIUM_RISK_FINDINGS.json
  │   ├─ CUSTOM_PATTERN_FINDINGS.json
  │   ├─ all_findings.json
  │   ├─ REPORT.txt
  │   └─ repos_scanned.json
  ├─ repos/              (repositories with findings)
  └─ raw_results/        (raw scanner outputs)

🔑 GitHub Token Setup

A GitHub token dramatically improves results and rate limits:

1. Go to: https://github.com/settings/tokens
2. Generate new token (classic)
3. Select scopes: public_repo, read:org, read:user
4. Set environment variable:

# Temporary (current session)
export GITHUB_TOKEN=ghp_xxxxxxxxxxxxx

# Permanent (add to ~/.bashrc or ~/.zshrc)
echo 'export GITHUB_TOKEN=ghp_xxxxxxxxxxxxx' >> ~/.bashrc
source ~/.bashrc

🛡️ Rate Limits & Best Practices

GitHub API Limits

• Without token: 60 requests/hour
• With token: 5,000 requests/hour

Best Practices

1. Always use a GitHub token
2. Run during off-peak hours for large scans
3. Respect rate limits (built-in delays included)
4. Review scan scope before execution
5. Store findings securely
6. Delete findings after remediation

📚 Use Cases

Bug Bounty Research

1. Identify organization employees
2. Scan public repositories for secrets
3. Report findings through proper channels
4. Follow responsible disclosure

Security Audits

1. Discover shadow IT repositories
2. Find leaked credentials
3. Identify exposed API keys
4. Track company domain references

Red Team Engagements

1. OSINT on target organization
2. Identify potential attack vectors
3. Discover exposed infrastructure
4. Map employee footprint

🔍 Examples

Full Workflow Example

# 1. Set your GitHub token
export GITHUB_TOKEN=ghp_your_token

# 2. Discover employees
python3 Mind_Finder.py -c Acme -d acme.com

# 3. Review the discovered employees
cat usernames_Acme.txt

# 4. Scan with custom patterns
python3 Mind_Scanner.py \
  -c Acme \
  -d acme.com \
  --manual usernames_Acme.txt \
  -p examples/patterns/acme_patterns.json

# 5. Review high-risk findings
cat github_hunt_Acme_*/reports/HIGH_RISK_FINDINGS.json

🤝 Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch
3. Test thoroughly
4. Submit a pull request

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• TruffleHog - Secret scanning engine
• Gitleaks - Secret detection tool
• GitHub API for making this research possible

⭐ Star History

If you find this tool useful, please consider giving it a star!

---

Remember: With great power comes great responsibility. Use these tools ethically and legally.