loading
Loading content
loading
OSINT
OSINT paste-site search for credentials and brand terms.
overview
pastos searches public paste sites for the strings in --search. Hand it a comma-separated list of domains, email patterns, or product names and it returns matching pastes.
Treat it as monitoring as much as a one-off query. The same term list on a schedule becomes a tripwire for credentials, API keys, and source fragments that land on paste services.
Wire --search and optional --api-key; output is a FILE and FOLDER of matches. Pair with h8mail for email-based breach lookups, or a git secret scanner when the leak path is source control.
use cases
Search paste sites for your domain and email patterns to catch credentials and keys that have been dumped publicly.
Run a term list for product names and internal identifiers to surface pastes that reference your organization.
Run the same search list on a schedule so new pastes mentioning your terms get flagged as they appear.
Route paste matches into the same triage and reporting flow as other leak-hunting tools for one view of exposure.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| search | STRING | --search | Comma-separated list of terms to search for in paste sites. |
| api-key | STRING | --api-key | API key for paste-site access. |
| debug | BOOLEAN | --debug | Enable debug output. |
Showing key inputs. pastos exposes 3 inputs in total.
example
# search paste sites for domain and API host mentionspastos --search example.com,api.example.com --api-key "$PASTOS_API_KEY"[+] Searching: example.com,api.example.com[+] Match: paste mentions example.com admin reset link[+] Match: paste lists api.example.com bearer token fragment[+] Match: paste dumps mail.example.com SMTP creds[+] Match: paste references staging.example.com config[+] Match: paste cites app.example.com session cookie[+] Done: 5 paste hits for search termsguidance
Use pastos when you want to catch your strings on public paste sites: leaked credentials, API hosts, or brand mentions. It searches pastes by term. For email breach corpora, pair with h8mail; for secrets in repos, use a git secret scanner.
Looks up breached credentials by email across leak corpora. pastos searches live paste sites by arbitrary strings.
Searches leaked secrets across broader sources. pastos targets paste sites by term.
Finds secrets committed to repos. pastos watches public paste sites instead of source control.
faq
related
Passive DNS records from DNSDumpster.
Generate lookalike domains and flag registered typosquats.
Look up the real IP of a host from its favicon via Shodan.
Email OSINT from public sources, with optional breach checks.
Check whether emails and usernames are available, taken, or invalid.
Passive DNSDumpster host lookup by domain.
A list of search terms feeds pastos, which scans paste sites and writes the pastes that mention your strings as a queryable output.
Facts on this page come from the live Trickest tool library.