{"id":13468159,"url":"https://github.com/jofpin/trape","last_synced_at":"2026-10-18T22:26:26.904Z","repository":{"id":37735450,"uuid":"109004193","full_name":"jofpin/trape","owner":"jofpin","description":"People tracker on the Internet: OSINT analysis and research tool by Jose Pino","archived":false,"fork":false,"pushed_at":"2024-06-20T19:04:00.000Z","size":6711,"stargazers_count":9037,"open_issues_count":255,"forks_count":1364,"subscribers_count":359,"default_branch":"master","last_synced_at":"2026-09-28T12:48:13.597Z","etag":null,"topics":["flask","footprint","hacking","hacking-tool","jose-pino","osint","phising","python","recognition","security","social-engineering","tracking"],"latest_commit_sha":null,"homepage":"https://x.com/jofpin","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jofpin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-10-31T14:03:57.000Z","updated_at":"2026-09-27T18:18:03.000Z","dependencies_parsed_at":"2022-08-08T21:30:44.760Z","dependency_job_id":"56207c47-a505-4b74-8c1d-f705c8e3c681","html_url":"https://github.com/jofpin/trape","commit_stats":{"total_commits":102,"total_committers":21,"mean_commits":4.857142857142857,"dds":"0.48039215686274506","last_synced_commit":"6baae245691997742a51979767254d7da580eadd"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/jofpin/trape","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jofpin%2Ftrape","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jofpin%2Ftrape/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jofpin%2Ftrape/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jofpin%2Ftrape/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jofpin","download_url":"https://codeload.github.com/jofpin/trape/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jofpin%2Ftrape/sbom","scorecard":{"id":527692,"data":{"date":"2025-08-11","repo":{"name":"github.com/jofpin/trape","commit":"6baae245691997742a51979767254d7da580eadd"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":2.5,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":9,"reason":"Found 11/12 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":0,"reason":"license file not detected","details":["Warn: project does not have a license file"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":0,"reason":"36 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-3rq5-2g8h-59hc","Warn: Project is vulnerable to: PYSEC-2018-66 / GHSA-562c-5r94-xh97","Warn: Project is vulnerable to: PYSEC-2019-179 / GHSA-5wv5-4vpf-pj6m","Warn: Project is vulnerable to: PYSEC-2023-62 / GHSA-m2qf-hxjv-5gpq","Warn: Project is vulnerable to: GHSA-43qf-4rqw-9q2g","Warn: Project is vulnerable to: GHSA-7rxf-gvfg-47g4","Warn: Project is vulnerable to: GHSA-84pr-m4jr-85g5","Warn: Project is vulnerable to: GHSA-8vgw-p6qm-5gr7","Warn: Project is vulnerable to: PYSEC-2024-71 / GHSA-hxwh-jpp2-84pm","Warn: Project is vulnerable to: PYSEC-2020-43 / GHSA-xc3p-ff3m-f46v","Warn: Project is vulnerable to: PYSEC-2019-217 / GHSA-462w-v97r-4m45","Warn: Project is vulnerable to: PYSEC-2014-8 / GHSA-8r7q-cvjq-x353","Warn: Project is vulnerable to: GHSA-cpwx-vrp4-4pq7","Warn: Project is vulnerable to: PYSEC-2014-82 / GHSA-fqh9-2qgg-h84h","Warn: Project is vulnerable to: PYSEC-2021-66 / GHSA-g3rq-g295-4j3m","Warn: Project is vulnerable to: GHSA-h5c8-rqwp-cp95","Warn: Project is vulnerable to: GHSA-h75v-3vvj-5mfj","Warn: Project is vulnerable to: PYSEC-2019-220 / GHSA-hj2j-77xm-mc5v","Warn: Project is vulnerable to: GHSA-q2x7-8rv6-6q7h","Warn: Project is vulnerable to: PYSEC-2019-170 / GHSA-j3jp-gvr5-7hwq","Warn: Project is vulnerable to: PYSEC-2014-14 / GHSA-652x-xj99-gmcc","Warn: Project is vulnerable to: GHSA-9hjg-9r4m-mvj7","Warn: Project is vulnerable to: GHSA-9wx4-h78v-vm56","Warn: Project is vulnerable to: PYSEC-2014-13 / GHSA-cfj3-7x9c-4p3h","Warn: Project is vulnerable to: PYSEC-2018-28 / GHSA-x84v-xcm2-53pg","Warn: Project is vulnerable to: GHSA-2g68-c3qc-8985","Warn: Project is vulnerable to: PYSEC-2020-157 / GHSA-3p3h-qghp-hvh2","Warn: Project is vulnerable to: GHSA-f9vj-2wh5-fj8j","Warn: Project is vulnerable to: PYSEC-2019-140 / GHSA-gq9m-qvpx-68hc","Warn: Project is vulnerable to: PYSEC-2017-43 / GHSA-h2fp-xgx6-xh6f","Warn: Project is vulnerable to: PYSEC-2023-221 / GHSA-hrfv-mqp8-q5rw","Warn: Project is vulnerable to: GHSA-j544-7q9p-6xp8","Warn: Project is vulnerable to: PYSEC-2023-57 / GHSA-px8h-6qxv-m22q","Warn: Project is vulnerable to: GHSA-q34m-jh98-gwm2","Warn: Project is vulnerable to: PYSEC-2023-58 / GHSA-xg9f-g7g7-2323","Warn: Project is vulnerable to: PYSEC-2022-203"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 29 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-20T04:52:32.094Z","repository_id":37735450,"created_at":"2025-08-20T04:52:32.094Z","updated_at":"2025-08-20T04:52:32.094Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38342756,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-18T02:00:06.448Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["flask","footprint","hacking","hacking-tool","jose-pino","osint","phising","python","recognition","security","social-engineering","tracking"],"created_at":"2024-07-31T15:01:06.403Z","updated_at":"2026-10-18T22:26:26.398Z","avatar_url":"https://github.com/jofpin.png","language":"Python","funding_links":[],"categories":["Tools","Python","Security","Uncategorized","\u003ca id=\"8f92ead9997a4b68d06a9acf9b01ef63\"\u003e\u003c/a\u003e扫描器\u0026\u0026安全扫描\u0026\u0026App扫描\u0026\u0026漏洞扫描","security","Python (1887)","\u003ca id=\"132036452bfacf61471e3ea0b7bf7a55\"\u003e\u003c/a\u003e工具","PHONE","📦 Legacy \u0026 Inactive Projects","hacking"],"sub_categories":["OSINT","Security Tools","Uncategorized","\u003ca id=\"58d8b993ffc34f7ded7f4a0077129eb2\"\u003e\u003c/a\u003e隐私\u0026\u0026Secret\u0026\u0026Privacy扫描"],"readme":"trape (stable) v2.0\n========\n\nPeople tracker on the Internet: Learn to track the world, to avoid being traced.\n\n---\nTrape is an **OSINT** analysis and research tool, which allows people to track and execute intelligent **social engineering** attacks in real time. It was created with the aim of teaching the world how large Internet companies could obtain **confidential information** such as the status of sessions of their websites or services and control their users through their browser, without their knowledge, but It evolves with the aim of helping **government** organizations, companies and **researchers** to track the cybercriminals.\n\n![--trape header](https://i.imgur.com/2ycpXEj.png)\n\n\nAt the beginning of the year 2018 was presented at **BlackHat Arsenal in Singapore**: https://www.blackhat.com/asia-18/arsenal.html#jose-pino and in multiple security events worldwide.\n\nSome benefits\n-----------\n* **LOCATOR OPTIMIZATION:** Trace the path between you and the target you're tracking. Each time you make a move, the path will be updated, the location of the target is obtained silently through a bypass made in the browsers, allowing you to skip the location request on the victim's side, and at the same time maintain a precision of **99%** in the locator.\n\n![](https://lh3.googleusercontent.com/qwq4LzzLTdFGwsGd8C3c9gxbDaN191s7lnvz75y0trwIMUGSaIu22QyBRgwKXxRwLBC5HGekBJLw9qgD5lnxgszcFVqJ24RVqv3q_T3HzD6wJeQU6oY4VVF8QT6Y83hstqD4C020)\n* **APPROACH:** When you're close to the target, Trape will tell you.\n\n![](https://lh4.googleusercontent.com/NFnVGLoDF2BmM_N56w8Vf6cnyg1WWIIKgGC1MeBTKXxcIynMDfC1ZSu43ftoiYnwcBb2gjpVdS4y0zm5K7XAzvXf7bPIt5ZrWQCEq9eQuN8KL-SRPOtBgIZL53AWkJjwhC4gJUcG)\n\n*  **REST API:** Generates an API (random or custom), and through this you can control and monitor other Web sites on the Internet remotely, getting the traffic of all visitors.\n\n![](https://lh6.googleusercontent.com/DtQiYYLoL9di3LPcSSTCZ3AuVMlQaNcDkBdv_fZFX7rztjg_epWmIaA2AlGsWCr5Mwr2nVfLcsg1I5PXEcx87ErLS8JaruvRsEUIkScydXA3JhvbsmJov7qxbKooGgD5u32kmBHW)\n\n* **PROCESS HOOKS:** Manages social engineering attacks or processes in the target's browser.\n    \n  --- **SEVERAL:** You can issue a phishing attack of any domain or service in real time as well as send malicious files to compromise the device of a target.\n    \n\n  ---  **INJECT JS:** You keep the JavaScript code running free in real time, so you can manage the execution of a **keylogger** or your own custom functions in JS which will be reflected in the target's browser.\n    \n  ---   **SPEECH:** A process of audio creation is maintained which is played in the browser of the target, by means of this you can execute personalized messages in different voices with languages in Spanish and English.\n    \n\n  \n\n* **PUBLIC NETWORK TUNNEL:** Trape has its own **API** that is linked to [ngrok.com](https://ngrok.com) to allow the automatic management of public network tunnels; So you can publish the content of your trape server which is executed locally to the Internet, to manage hooks or public attacks.\n\n![](https://lh5.googleusercontent.com/_f3zaCeZya_5AKaCoaPexyJVpNA7fiRqYQ9WBRiGLsHcx1W5V61V-VENeIRF2QbqvpenyOJ1AYyreTmOr2MWbf9PYu4qXF-tbYWi7qp6ZWeOwvoG3LYUdpjp3pAK9mIAQZzPJwAO)\n\n\n* **CLICK ATTACK TO GET CREDENTIALS:** Automatically obtains the target credentials, recognizing your connection availability on a social network or Internet service.\n\n![](https://lh4.googleusercontent.com/IN8xWfHjGPRQ__-QwTXebG-087m4JzDIVFWtSlUtrnRpDn2d0U1cnQdNGqLQZA35-fneej1iTpkxgHZCq_pWZLlCd1SmyLZ-WJ5Juj2KbtyNbX4jI1oLUtqupxieH91mX65_ZmHy)\n\n* **NETWORK:** You can get information about the user's network.\n\n  ---  **SPEED:** Viewing the target's network speed. (Ping, download, upload, type connection)\n\n  --- **HOSTS OR DEVICES:** Here you can get a scan of all the devices that are connected in the target network automatically.\n\n![](https://lh3.googleusercontent.com/gkOWunWn7ge5yJt00lMBN_7GwSUxrAQV2y64ysyrjmD-vz_lO3bu6UkRjPJF8OljxyMTNlWVA9W8gVU3U0iI3RrECNNkr7H44Lz6z5Zj3-bA_hDF5TnTSoV_6584qFvuLkmShTQD)\n\n\n* **PROFILE:** Brief summary of the target's behavior and important additional information about your device.\n\n  ---   **GPU**\n  ---   **ENERGY**\n\n30-session recognition\n-------\nSession recognition is one of trape most interesting attractions, since you as a researcher can know remotely what service the target is connected to.\n\n![](https://lh6.googleusercontent.com/IFxIh7Eemr63kycj2eBzJYvevCzLH5DkQGWUKzPx_Okn4WoExPl0LR7Qj-cSc0WF0rs9Ew6DJMwcyirZd0kdfLpdrqQ2700P_xdxW7wpZ7K6OWi8pluLKivHtU45HD4VtyM0lLwh)\n\n* **USABILITY:** You can delete logs and view alerts for each process or action you run against each target.\n \n ![](https://lh4.googleusercontent.com/dXx1lRG2z-ZlSIlQyTx_ra7sbkgKG2jeqGjIt86GebFiAaZyFDA4vy3QBLACd-1wOz4zdSIARWvo3hK2mEvrSJ6VPDSiOZgMLB4rUYXKDHrone0xIB3bwhAKPnsJUcuKW9xf_-sG)\n \nHow to use it\n-------\n First unload the tool.\n```\ngit clone https://github.com/jofpin/trape.git\ncd trape\npython3 trape.py -h\n```\nIf it does not work, try to install all the libraries that are located in the file **requirements.txt**\n```\npip3 install -r requirements.txt\n```\n\nExample of execution\n```\nExample: python3 trape.py --url http://example.com --port 8080\n```\n\nIf you face some problems installing the tool, it is probably due to Python versions conflicts, you should run a Python 2.7 environment :\n\n```\npip3 install virtualenv\nvirtualenv -p /usr/bin/python3 trape_env\nsource trape_env/bin/activate\npip3 install -r requirements.txt\npython3 trape.py -h\n```\n\n**HELP  AND OPTIONS**\n```\nuser:~$ python3 trape.py --help\nusage: python3 trape.py -u \u003c\u003e -p \u003c\u003e [-h] [-v] [-u URL] [-p PORT]\n                                              [-ak ACCESSKEY] [-l LOCAL]\n                                              [--update] [-n] [-ic INJC]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -v, --version         show program's version number and exit\n  -u URL, --url URL     Put the web page url to clone\n  -p PORT, --port PORT  Insert your port\n  -ak ACCESSKEY, --accesskey ACCESSKEY\n                        Insert your custom key access\n  -l LOCAL, --local LOCAL\n                        Insert your home file\n  -n, --ngrok           Insert your ngrok Authtoken\n  -ic INJC, --injectcode INJC\n                        Insert your custom REST API path\n  -ud UPDATE, --update UPDATE\n                        Update trape to the latest version\n```\n\n**--url**  In this option you add the URL you want to clone, which works as a decoy.\n\n**--port**  Here you insert the port, where you are going to run the  **trape server**.\n\n**--accesskey**  You enter a custom key for the  **trape panel**, if you do not insert it will generate an  **automatic key**.\n\n**--injectcode**  trape contains a  **REST API**  to play anywhere, using this option you can customize the name of the file to include, if it does not, generates a random name allusive to a token.\n\n**--local**  Using this option you can call a local **HTML file**, this is the replacement of the  **--url**  option made to run a local lure in trape.\n\n**--ngrok**  In this option you can enter a token, to run at the time of a process. This would replace the token saved in configurations.\n\n**--version**  You can see the version number of trape.\n\n**--update**  Option used to upgrade to the latest version of **trape**.\n\n**--help**  It is used to see all the above options, from the executable.\n\n\nDisclaimer\n-------\nThis tool has been published educational purposes. It is intended to teach people how bad guys could track them, monitor them or obtain information from their credentials, we are not responsible for the use or the scope that someone may have through this project.\n\nWe are totally convinced that if we teach how vulnerable things really are, we can make the Internet a safer place.\n\nDeveloper\n-------\nThis development and others, the participants will be mentioned with name, Twitter and charge.\n\n* **CREATOR**\n\n  --- Jose Pino - [@jofpin](https://twitter.com/jofpin) - (**Security Researcher**) \n \n\nHappy hacking!\n-------\nI invite you, if you use this tool helps to share, collaborate. Let's make the Internet a safer place, let's report.\n\n\n## License\n\nThe content of this project itself is licensed under the [Creative Commons Attribution 3.0 license](http://creativecommons.org/licenses/by/3.0/us/deed.en_US), and the underlying source code used to format and display that content is licensed under the [MIT license](http://opensource.org/licenses/mit-license.php).\n\nCopyright, 2018 by [Jose Pino](https://twitter.com/jofpin) \n\n-------------\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjofpin%2Ftrape","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjofpin%2Ftrape","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjofpin%2Ftrape/lists"}