{"id":15038717,"url":"https://github.com/bee-san/pywhat","last_synced_at":"2026-10-18T23:06:26.549Z","repository":{"id":38409802,"uuid":"349553695","full_name":"bee-san/pyWhat","owner":"bee-san","description":"🐸   Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️","archived":false,"fork":false,"pushed_at":"2026-10-05T09:39:08.000Z","size":6639,"stargazers_count":7326,"open_issues_count":2,"forks_count":393,"subscribers_count":66,"default_branch":"main","last_synced_at":"2026-10-10T21:33:15.134Z","etag":null,"topics":["cyber","cybersecurity","hacking","hacktoberfest","malware","malware-analysis","malware-research","pcap","python","re","security","tryhackme"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bee-san.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null},"funding":{"github":"bee-san","patreon":null,"open_collective":null,"ko_fi":"hacker","tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":["https://www.buymeacoffee.com/beecodes","http://paypal.me/brandonskerritt"]}},"created_at":"2021-03-19T20:59:05.000Z","updated_at":"2026-10-09T18:08:45.000Z","dependencies_parsed_at":"2024-01-18T15:52:52.826Z","dependency_job_id":"69ef9e69-4483-46d6-a492-351dbcb9cb8c","html_url":"https://github.com/bee-san/pyWhat","commit_stats":{"total_commits":415,"total_committers":44,"mean_commits":9.431818181818182,"dds":0.7469879518072289,"last_synced_commit":"8a83d28127a488b2b451f3b8b2d75dbbd704a214"},"previous_names":[],"tags_count":19,"template":false,"template_full_name":null,"purl":"pkg:github/bee-san/pyWhat","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bee-san%2FpyWhat","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bee-san%2FpyWhat/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bee-san%2FpyWhat/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bee-san%2FpyWhat/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bee-san","download_url":"https://codeload.github.com/bee-san/pyWhat/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bee-san%2FpyWhat/sbom","scorecard":{"id":230071,"data":{"date":"2025-08-11","repo":{"name":"github.com/bee-san/pyWhat","commit":"75a1592cbc4151acdaaeab78b71dd65ea9a9230e"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.8,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/main.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/bee-san/pyWhat/main.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/bee-san/pyWhat/main.yaml/main?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:1: pin your Docker image by updating python:3.10-alpine to python:3.10-alpine@sha256:9b476281f12d7b7772725b99d076e23fa36a5d0886ae32e8dd68e14c918a4b71","Warn: pipCommand not pinned by hash: Dockerfile:2-5","Warn: pipCommand not pinned by hash: .github/workflows/main.yaml:20","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 containerImage dependencies pinned","Info:   0 out of   2 pipCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":0,"reason":"16 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: PYSEC-2024-48 / GHSA-fj7x-q9j7-g6q6","Warn: Project is vulnerable to: PYSEC-2024-230 / GHSA-248v-346w-9cwc","Warn: Project is vulnerable to: PYSEC-2022-42986 / GHSA-43fp-rhv2-5gv8","Warn: Project is vulnerable to: PYSEC-2023-135 / GHSA-xqr8-7jwr-rhp7","Warn: Project is vulnerable to: PYSEC-2024-60 / GHSA-jjg7-2v4v-x38h","Warn: Project is vulnerable to: PYSEC-2024-40 / GHSA-pwr2-4v36-6qpr","Warn: Project is vulnerable to: PYSEC-2022-42969","Warn: Project is vulnerable to: PYSEC-2023-117 / GHSA-mrwq-x4v8-fh7p","Warn: Project is vulnerable to: GHSA-9hjg-9r4m-mvj7","Warn: Project is vulnerable to: GHSA-9wx4-h78v-vm56","Warn: Project is vulnerable to: PYSEC-2023-74 / GHSA-j8r2-6x86-q33q","Warn: Project is vulnerable to: GHSA-34jh-p97f-mpxf","Warn: Project is vulnerable to: PYSEC-2023-212 / GHSA-g4mx-q9vg-27p4","Warn: Project is vulnerable to: GHSA-pq67-6m6q-mj2v","Warn: Project is vulnerable to: PYSEC-2023-192 / GHSA-v845-jxx5-vc9f","Warn: Project is vulnerable to: GHSA-jfmj-5v4g-7637"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T04:41:47.804Z","repository_id":38409802,"created_at":"2025-08-17T04:41:47.804Z","updated_at":"2025-08-17T04:41:47.804Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38343410,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-18T02:00:06.448Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cyber","cybersecurity","hacking","hacktoberfest","malware","malware-analysis","malware-research","pcap","python","re","security","tryhackme"],"created_at":"2024-09-24T20:39:51.496Z","updated_at":"2026-10-18T23:06:26.542Z","avatar_url":"https://github.com/bee-san.png","language":"Python","funding_links":["https://github.com/sponsors/bee-san","https://ko-fi.com/hacker","https://www.buymeacoffee.com/beecodes","http://paypal.me/brandonskerritt"],"categories":[],"sub_categories":[],"readme":"\u003cp align='center'\u003e\n\u003cimg src='images/logo.png'\u003e\n\u003cp align=\"center\"\u003e➡️ \u003ca href=\"http://discord.skerritt.blog\"\u003eDiscord\u003c/a\u003e ⬅️\u003cbr\u003e\n\u003ci\u003eThe easiest way to identify anything\u003c/i\u003e\u003cbr\u003e\n\u003ccode\u003epip3 install pywhat \u0026\u0026 pywhat --help\u003c/code\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"http://discord.skerritt.blog\"\u003e\u003cimg alt=\"Discord\" src=\"https://img.shields.io/discord/754001738184392704\"\u003e\u003c/a\u003e \u003ca href=\"https://pypi.org/project/pywhat/\"\u003e\u003cimg alt=\"PyPI - Downloads\" src=\"https://pepy.tech/badge/pywhat/month\"\u003e\u003c/a\u003e  \u003ca href=\"https://twitter.com/bee_sec_san\"\u003e\u003cimg alt=\"Twitter Follow\" src=\"https://img.shields.io/twitter/follow/bee_sec_san?style=social\"\u003e\u003c/a\u003e \u003ca href=\"https://pypi.org/project/pywhat/\"\u003e\u003cimg alt=\"PyPI - Python Version\" src=\"https://img.shields.io/pypi/pyversions/pywhat\"\u003e\u003c/a\u003e \u003ca href=\"https://pypi.org/project/pywhat/\"\u003e\u003cimg alt=\"PyPI\" src=\"https://img.shields.io/pypi/v/pywhat\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\u003chr\u003e\n\n# 🤔 `What` is this?\n\n![](images/main_demo.gif)\n\nImagine this: You come across some mysterious text 🧙‍♂️ `0x52908400098527886E0F7030069857D2E4169EE7` or `dQw4w9WgXcQ` and you wonder what it is. What do you do?\n\nWell, with `what` all you have to do is ask `what \"0x52908400098527886E0F7030069857D2E4169EE7\"` and `what` will tell you!\n\n`what`'s job is to **identify _what_ something is.** Whether it be a file or text! Or even the hex of a file! What about text _within_ files? We have that too! `what` is recursive, it will identify **everything** in text and more!\n\n# Installation\n\n## 🔨 Using pip\n\n```$ pip3 install pywhat```\n\nor\n\n```shell\n# installs optional dependencies that may improve the speed\n$ pip3 install pywhat[optimize] \n```\n\n## 🔨 On Mac?\n\n```$ brew install pywhat```\n\nOr for our MacPorts fans:\n\n```$ sudo port install pywhat```\n\n# ⚙ Use Cases\n\n## 🦠 Wannacry\n\n![](images/wannacry_demo.png)\n\nYou come across a new piece of malware called WantToCry. You think back to Wannacry and remember it was stopped because a researcher found a kill-switch in the code.\n\nWhen a domain, hardcoded into Wannacry, was registered the virus would stop.\n\nYou use `What` to identify all the domains in the malware, and use a domain registrar API to register all the domains.\n\n## 🦈 Faster Analysis of Pcap files\n\n![](images/pcap_demo.gif)\n\nSay you have a `.pcap` file from a network attack. `What` can identify this and quickly find you:\n\n- All URLs\n- Emails\n- Phone numbers\n- Credit card numbers\n- Cryptocurrency addresses\n- Social Security Numbers\n- and much more.\n\nWith `what`, you can identify the important things in the pcap in seconds, not minutes.\n\n## 🐞 Bug Bounties\n\nYou can use PyWhat to scan for things that'll make you money via bug bounties like:\n* API Keys\n* Webhooks\n* Credentials\n* and more\n\nRun PyWhat with:\n\n```\npywhat --include \"Bug Bounty\" TEXT\n```\n\nTo do this.\n\nHere are some examples 👇\n\n### 🐙 GitHub Repository API Key Leaks\n\n1. Download all GitHub repositories of an organisation\n2. Search for anything that you can submit as a bounty, like API keys\n\n```shell\n# Download all repositories\nGHUSER=CHANGEME; curl \"https://api.github.com/users/$GHUSER/repos?per_page=1000\" | grep -o 'git@[^\"]*' | xargs -L1 git clone\n\n# Will print when it finds things.\n# Loops over all files in current directory.\nfind . -type f -execdir pywhat --include 'Bug Bounty' {} \\;\n```\n\n### 🕷 Scan all web pages for bounties\n\n```shell\n# Recursively download all web pages of a site\nwget -r -np -k https://skerritt.blog\n\n# Will print when it finds things.\n# Loops over all files in current directory.\nfind . -type f -execdir pywhat --include 'Bug Bounty' {} \\;\n```\n\n**PS**: We support more filters than just bug bounties! Run `pywhat --tags`\n\n## 🌌 Other Features\n\nAnytime you have a file and you want to find structured data in it that's useful, `What` is for you.\n\nOr if you come across some piece of text and you don't know what it is, `What` will tell you.\n\n### 📁 File \u0026 Directory Handling\n\n**File Opening** You can pass in a file path by `what 'this/is/a/file/path'`. `What` is smart enough to figure out it's a file!\n\nWhat about a whole **directory**? `What` can handle that too! It will **recursively** search for files and output everything you need!\n\n**Multiple inputs** You can pass several files, directories or texts at once, like `what file1 file2 this/is/a/directory 'some text'` or `find . -name '*.log' -exec what {} +`. `What` shows the file of every match, the matches in text are under `text`, and `--json` returns everything in one JSON object.\n\n**Unicode** Files and text piped into `What` can be UTF-8, or UTF-16 or UTF-32 with a byte order mark, like the \"Unicode\" text files that Windows saves. `What` also searches the UTF-16 strings in binary files (like `strings -el`), which is how Windows programs store most of their text. Characters that your terminal cannot show are printed as escape sequences such as `\\u20bf` instead of crashing.\n\n### 🔍 Filtering your output\n\nSometimes, you only care about seeing things which are related to AWS. Or bug bounties, or cryptocurrencies!\n\nYou can filter output by using `what --rarity 0.2:0.8 --include Identifiers,URL https://skerritt.blog`. Use `what --help` to get more information.\n\nBy default, `what` only shows matches with a rarity of 0.1 or more, as matches with a lower rarity are often false positives. For example, a YouTube video ID on its own, like `dQw4w9WgXcQ`, could be any 11 random characters, so `what dQw4w9WgXcQ` finds nothing, but `what --rarity 0: dQw4w9WgXcQ` shows it. YouTube links, like `https://youtu.be/dQw4w9WgXcQ` or `youtube.com/watch?v=dQw4w9WgXcQ\u0026t=42s`, are shown by default.\n\nTo see all filters, run `pywhat --tags`! You can also combine them, for example to see all cryptocurrency wallets minus Ripple you can do:\n\n```console\npywhat --include \"Cryptocurrency Wallet\" --exclude \"Ripple Wallet\" 1KFHE7w8BhaENAswwryaoccDb6qcT6DbYY\n```\n\nThe names of the regexes work like tags, and many regexes have shorter alternative names too, such as `BTC Wallet` for `Bitcoin (₿) Wallet Address` or `ARN` for `Amazon Resource Name (ARN)`. To only see Bitcoin and Ethereum wallets:\n\n```console\npywhat --include \"BTC Wallet,ETH Wallet\" TEXT\n```\n\nRun `pywhat --names` to see the name of every regex with its alternative names.\n\n### 👽 Sorting, Exporting, and more!\n\n**Sorting** You can sort the output by using `what -k rarity --reverse TEXT`. Use `what --help` to get more information.\n\n**Top matches** Found too much? `what --top 10 TEXT` only shows the 10 most likely matches, most likely first, and `what --top 5% TEXT` the most likely 5% of them. For a directory or several inputs, these are the most likely matches of all of them. The most likely matches have the highest rarity, but fragments of a longer word or match, which boundaryless mode finds, are less likely: `what --top 1 0x52908400098527886E0F7030069857D2E4169EE7` shows the Ethereum address, not the card and social security numbers in it. `what -k likely TEXT` shows all matches in this order. In the API, `pywhat.ranking.top_matches(identified, 10)` keeps the 10 most likely matches of what `Identifier.identify()` returns, and the `\"Fragment\"` key of a match says whether it is a fragment.\n\n**Exporting** You can export to json using `what --json` and results can be sent directly to a file using `what --json \u003e file.json`. The JSON is printed on one line, so it can be piped to other programs too, like `what --json TEXT | jq`.\n\n**Progress and streaming** When a search takes a while, like on a big file or directory, progress bars show how far `What` is: how many of the regexes it has searched the file for, with the one it is searching for now, and for a directory or several inputs how many of the files it has searched. They are only shown on a terminal (on stderr if the output is redirected to a file) and go away once the search is complete, `--no-progress` turns them off. With `--stream`, `What` prints every match as soon as it finds it, instead of once the search is complete: `what --stream big.log`, or `what --stream --json big.log \u003e matches.jsonl` for a JSON object per match, one per line. As it does not wait for all the matches, `--stream` cannot sort them (`--key`) or only show the most likely ones (`--top`), and its JSON has no `\"Fragment\"` key.\n\n**Boundaryless mode** `What` has a special mode to match identifiable information within strings. By default, it is enabled in CLI but disabled in API. Use `what --help` or refer to [API Documentation](https://github.com/bee-san/pyWhat/wiki/API) for more information.\n\n**Processing** Once a regex has found something, `What` can process it further, beyond what a regex can do. For example, the date of a Unix timestamp is added to its description: `what --rarity 0: --include \"UNIX Timestamp\" 1637093119` shows `Date: November 16, 2021 8:05:19 PM UTC`. Bitcoin wallet addresses have a checksum, so a match whose checksum is wrong, like `3F3F3F3F3F3F3F3F3F3F3F3F3F3F3F3F3F`, is filtered out. Use `what --disable-processing` to turn this off.\n\n**Verifying keys** `what --verify` asks the services whether the keys it finds are valid, and adds the answer to their description. For now it verifies Google API keys: `what --verify AIzaSyA00000000000000000000000000000000` shows `Verification: invalid, Google rejected the key (API_KEY_INVALID)`. A key that is valid but cannot use the API it was tested with (e.g. `SERVICE_DISABLED`) is reported as valid. Verification is off by default because it sends the keys to the services (over HTTPS, once per key), so only use it for keys you are allowed to test. The Exploit of a key also contains the `curl` command to verify it yourself.\n\n**Maps** Coordinates link to Google Maps. Use `what --map osm` to link them to OpenStreetMap instead: `what --map osm '52.6169586, -1.9779857'` shows `Link: https://www.openstreetmap.org/search?query=52.6169586,-1.9779857`.\n\n### 💬 Interactive mode\n\nAnalysing something big? Load it into memory once with `--interactive`, then search through what `What` found as often as you like, without scanning it again:\n\n```console\n$ pywhat --interactive .\npywhat\u003e tags\npywhat\u003e include Bug Bounty\npywhat\u003e top 10\npywhat\u003e more\npywhat\u003e location:\"/src\", include:\"Bug Bounty\", exclude:\"Credit Card\", rarity:\"0.1:0.6\"\npywhat\u003e load another/directory\n```\n\n`tags` shows the tags of the current matches and how many matches have each of them, `include TAG` and `exclude TAG` narrow the search down. `top 10` only shows the 10 most likely matches of a search (`--top 10` does this from the start) and `more` the next 10. A search combines `location:`, `include:`, `exclude:`, `rarity:` and text to look for, and every part of it has to match. Where readline is available, Tab completes commands, search keys, tags, rarities and paths. Type `help` in interactive mode to see all commands.\n\n\n# 🍕 API\n\nPyWhat has an API! Click here [https://github.com/bee-san/pyWhat/wiki/API](https://github.com/bee-san/pyWhat/wiki/API) to read about it.\n\nYou can also process the matches with your own code, for example to filter out false positives. A processor gets every match of the regexes named in `names` and returns it, possibly changed (its description, rarity, ...), or `None` to filter it out. It is an object, so it can keep state between matches:\n\n```python\nfrom pywhat import Identifier, Processor\nfrom pywhat.processors import default_processors\n\n\nclass URLProcessor(Processor):\n    names = [\"Uniform Resource Locator (URL)\"]\n\n    def process(self, match):\n        if \"trashurl.it\" in match[\"Matched\"]:\n            return None\n        return match\n\n\nid = Identifier(processors=[*default_processors(), URLProcessor()])\nid.identify(\"https://trashurl.it/page\")\n```\n\n`Identifier(processors=[])` or `identify(text, processors=[])` turns processing off.\n\nTo verify keys with the API, like `--verify`, add the verifiers to the processors: `Identifier(processors=[*default_processors(), *verifiers()])`, with `verifiers` from `pywhat.processors`.\n\nTo link coordinates to OpenStreetMap, like `--map osm`, add `OpenStreetMapProcessor()` from `pywhat.processors` to the processors. The link of a match is then its `\"Link\"`, and `pywhat.printer.get_link(match)` gives the link of any match.\n\nTo get the matches while a search goes on, `iter_identify()` is a generator which yields what `identify()` finds as soon as it is found, as `(kind, location, value)`: `kind` is `\"File Signatures\"` or `\"Regexes\"`, `location` is the file (or `\"text\"`) and `value` is the file signature or the match. `identify()`, `identify_inputs()` and `iter_identify()` also call `progress`, if it is given, with a `Progress` before every regex they search for and once a file has been searched:\n\n```python\nfrom pywhat import Identifier\n\nid = Identifier()\nfor kind, location, value in id.iter_identify(\"big/directory\", only_text=False):\n    if kind == \"Regexes\":\n        print(location, value[\"Matched\"], value[\"Regex Pattern\"][\"Name\"])\n\n\ndef show(progress):\n    # Which file (or \"text\"), how many of how many files are done, how many of\n    # how many regexes, and the regex that is searched for (None once done)\n    print(progress.location, progress.files_done, progress.files,\n          progress.regexes_done, progress.regexes, progress.regex)\n\n\nid.identify(\"big.log\", only_text=False, progress=show)\n```\n\n# 👾 Contributing\n\n`what` not only thrives on contributors, but can't exist without them! If you want to add a new regex to check for things, you can read our documentation [here](https://github.com/bee-san/what/wiki/Adding-your-own-Regex)\n\nIf a regex is known by other names, such as an abbreviation, list them in its optional `\"Alternative Names\"` in [regex.json](pywhat/Data/regex.json) rather than adding them as tags. Tags are for groups of regexes, like `Bug Bounty`.\n\nNot sure which rarity to give your regex? `python scripts/rarity_score.py 'REGEX'` estimates it from the regex itself: the more specific characters a match has to contain, like the `ghp_` of a GitHub token, the rarer it is. `python scripts/rarity_score.py --database` compares the rarities in `regex.json` with their estimates, and `--help` explains how the estimate works.\n\nEvery regex needs examples in `regex.json`, which are run as tests. See [CONTRIBUTING.md](CONTRIBUTING.md) for how to add fake API keys as examples.\n\nWe ask contributors to join the Discord for quicker discussions, but it's not needed:\n\u003ca href=\"http://discord.skerritt.blog\"\u003e\u003cimg alt=\"Discord\" src=\"https://img.shields.io/discord/754001738184392704\"\u003e\u003c/a\u003e\n\n# 🙏 Thanks\n\nWe would like to thank [Dora](https://github.com/sdushantha/dora) for their work on a bug bounty specific regex database which we have used.\n\nWe would also like to thank [tomnomnom](https://github.com/tomnomnom) for the patterns in [gf](https://github.com/tomnomnom/gf), which some of our regexes are based on.\n\nSome of our regexes, like cron schedules, browser user agents, ISO 8601 timestamps, UK postcodes and regex101 permalinks, are based on the community library of [regex101](https://regex101.com/library).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbee-san%2Fpywhat","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbee-san%2Fpywhat","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbee-san%2Fpywhat/lists"}