Home

LeakGorilla 🦍 - Wiki

What is LeakGorilla

LeakGorilla is a powerful reconnaissance tool designed for penetration testers and security researchers to discover exposed API keys, credentials, and sensitive information in web applications.

It intelligently crawls websites and analyzes HTML, JavaScript, and CSS files to detect 20+ types of leaked secrets.

Installation

Kali Linux / Debian / Ubuntu (APT)

wget https://github.com/jeffryhawchab/leakgorilla/releases/download/v1.0.0/leakgorilla_1.0.0_all.deb
sudo dpkg -i leakgorilla_1.0.0_all.deb
sudo apt-get install -f

Python (No Installation)

git clone https://github.com/jeffryhawchab/leakgorilla.git
cd leakgorilla
pip3 install -r requirements.txt
python leakgorilla/scanner.py https://example.com

Usage

Basic Scan

# APT
leakgorilla https://example.com

# Python
python leakgorilla/scanner.py https://example.com

All Options

Option	Description	Default
`--max-pages N`	Maximum pages to crawl	50
`--timeout N`	Request timeout in seconds	10
`--delay N`	Delay between requests	0
`--proxy URL`	Proxy URL (e.g., Burp Suite)	None
`--verbose, -v`	Verbose output	False
`--output FILE`	Output file path	web_secrets.txt
`--format FORMAT`	Output format: txt, json, html	txt
`--wayback`	Scan Wayback Machine archives	False
`--patterns FILE`	Custom patterns JSON file	None
`--create-patterns`	Generate example patterns file	-
`--resume FILE`	Save/load scan state	None
`--clear-resume FILE`	Clear saved resume state	-

Features

Severity Scoring

Every finding is assigned a severity level:

🔴 CRITICAL - OpenAI, AWS, Stripe, Private Keys
🟠 HIGH - GitHub, Google, Meta, Database strings
🟡 MEDIUM - Slack, Twilio, JWT, OAuth tokens
🔵 LOW - Generic API keys and secrets

Concurrent Scanning

LeakGorilla scans JavaScript and CSS files concurrently using multi-threading for faster results.

Proxy Support

Route traffic through Burp Suite or any proxy:

leakgorilla https://example.com --proxy http://127.0.0.1:8080

Rate Limiting

Avoid detection and respect server resources:

leakgorilla https://example.com --delay 2

Detected Secrets

Secret Type	Severity	Example Pattern
OpenAI API Key	CRITICAL	`sk-...`
Anthropic Claude	CRITICAL	`sk-ant-...`
AWS Access Key	CRITICAL	`AKIA...`
Stripe API Key	CRITICAL	`sk_live_...`
Private Key	CRITICAL	`-----BEGIN RSA PRIVATE KEY-----`
Groq API Key	HIGH	`gsk_...`
Google API Key	HIGH	`AIza...`
GitHub Token	HIGH	`ghp_...`
Meta/Facebook	HIGH	`EAA...`
Database String	HIGH	`mongodb://...`
Slack Token	MEDIUM	`xoxb-...`
Twilio API Key	MEDIUM	`SK...`
JWT Token	MEDIUM	`eyJ...`
SendGrid	MEDIUM	`SG....`
Generic API Key	LOW	`api_key=...`

Output Formats

Text (default)

leakgorilla https://example.com --output results.txt

Human-readable report grouped by severity.

JSON

leakgorilla https://example.com --format json --output results.json

Machine-parsable for automation and CI/CD integration.

HTML

leakgorilla https://example.com --format html --output report.html

Beautiful dark-themed report with severity badges and context.

Custom Patterns

Generate Example File

leakgorilla https://example.com --create-patterns

Example custom_patterns.json

{
  "My Custom API Key": {
    "patterns": ["myapp-[a-zA-Z0-9]{32}"],
    "severity": "HIGH"
  },
  "Internal Token": {
    "patterns": ["tok_[a-zA-Z0-9]{40}"],
    "severity": "CRITICAL"
  }
}

Use Custom Patterns

leakgorilla https://example.com --patterns custom_patterns.json

Wayback Machine

Scan archived versions of a website to find secrets that may have been exposed in the past.

leakgorilla https://example.com --wayback

Resume Scan

# Start scan with resume support
leakgorilla https://example.com --resume scan_state.json

# Resume interrupted scan
leakgorilla https://example.com --resume scan_state.json

# Clear saved state
leakgorilla https://example.com --clear-resume scan_state.json

State is automatically saved every 10 pages.

Accuracy

Secret Type	Accuracy
OpenAI API Key	90-95%
Anthropic Claude	90-95%
Groq API Key	90-95%
GitHub Tokens	90-95%
AWS Access Keys	90-95%
Stripe API Keys	80-90%
Slack Tokens	80-90%
Database Strings	80-90%
Google API Keys	70-80%
JWT Tokens	70-80%
Generic Secrets	60-70%

Overall: ~75-85%

Focus on CRITICAL and HIGH severity findings for best accuracy (85-95%).

FAQ

Q: Is LeakGorilla legal to use? A: Only use LeakGorilla on websites you own or have explicit written permission to test.

Q: Why am I getting false positives? A: Focus on CRITICAL and HIGH severity findings to reduce false positives.

Q: Can I integrate LeakGorilla into CI/CD?

leakgorilla https://staging.app.com --format json | jq '.[] | select(.severity=="CRITICAL")'

LeakGorilla 🦍 - Use ethically and responsibly. Author: Jeffrey Hawchab | MIT License 2026

Navigation Menu

Repository navigation