# Pillager | Filesystems For Sensitive Information With Go

**URL:** <https://onehack.st/t/pillager-filesystems-for-sensitive-information-with-go/173916>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [February 28, 2021, 8:22am UTC](https://onehack.st/t/pillager-filesystems-for-sensitive-information-with-go/173916 "2021-02-28T08:22:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [February 28, 2021, 8:22am UTC](https://onehack.st/t/pillager-filesystems-for-sensitive-information-with-go/173916/1 "2021-02-28T08:22:33Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/8/8/88fc17470947461b9354b7bfaf52fac2e20cb577.jpeg)

Pillager is designed to provide a simple means of leveraging Go’s strong concurrency model to recursively search directories for sensitive information in files. Pillager does this by standing on the shoulders of [a few giants](https://github.com/brittonhayes/pillager#shoulders-of-giants). Once pillager finds files that match the specified pattern, the file is scanned using a series of concurrent workers that each take a line of the file from the job queue and hunt for sensitive pattern matches. The available pattern filters can be defined in a rules.toml file or you can use the default ruleset.

**Installation**

**Go**

If you have Go setup on your system, you can install Pillager with `go get`

```auto
go get github.com/brittonhayes/pillager

```

**Scoop (Windows)**

```auto
scoop bucket add pillager https://github.com/brittonhayes/pillager-scoop.gitscoop install pillager

```

**Homebrew (OSX/Linux)**

```auto
brew tap brittonhayes/homebrew-pillagerbrew install pillager

```

If you’re looking for a binary, check the latest releases for the executable that matches your system

**Usage**

To see all the commands available with `pillager`

```auto
# To see instructions for the entire applicationpillager# From any subcommandpillager [cmd] --help

```

**Configuration**

**Gitleaks Rules**

Pillager provides full support for [Gitleaks](https://github.com/zricethezav/gitleaks) rules. This can either be passed in with a [rules.toml](https://github.com/brittonhayes/pillager/blob/main/rules.toml) file, or you can use the default ruleset by leaving the rules flag blank.

```auto
# rules.tomltitle = "pillager rules"[[rules]]description = "AWS Access Key"regex = '''(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}'''tags = ["key", "AWS"][[rules.entropies]] Min = "3.5" Max = "4.5" Group = "1"[[rules]]description = "Email Address"regex = '''(?i)([A-Za-z0-9!#$%&'*+/=?^_{|.}~-]+@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)'''tags = ["email", "User Info"]

```

**Custom Templates**

Pillager allows you to use powerful `go text/template` to customize the output format. Here are a few template examples.

**Basic**

```auto
{{/*basic.tmpl*/}} {{ range .Leaks}} Leak: {{.Line}} Line: {{.LineNumber}} File: {{ .File }} {{end}}  

```

**Markdown Styling**

```auto
{{/*markdown.tmpl*/}} # Results {{ range .Leaks}} ## {{ .File }} - Location: {{.LineNumber}} {{end}}  

```

**Documentation**



[View the docs](https://github.com/brittonhayes/pillager/blob/main/hunter)

GoDoc documentation is available on [pkg.go.dev for pillager](https://pkg.go.dev/github.com/brittonhayes/pillager) but it also available for all packages in the [./pkg](https://github.com/brittonhayes/pillager/blob/main/pkg) directory. Just open the folder of any package, and you’ll see the GoDocs rendered in beautiful Github-flavored markdown thanks to the awesome [gomarkdoc](https://github.com/princjef/gomarkdoc) tool.

**Shoulders of Giants**

**[afero’s Cobra](https://github.com/spf13/cobra)**

**What is Cobra?**

> Cobra is a library providing a simple interface to create powerful modern CLI interfaces similar to git & go tools. Cobra is also an application that will generate your application scaffolding to rapidly develop a Cobra-based application.

If you’ve seen a CLI written in Go before, there’s a pretty high chance it was built with Cobra. I can’t recommend this library enough. It empowers developers to make consistent, dynamic, and self-documenting command line tools with ease. Some examples include `kubectl`, `hugo`, and Github’s `gh` CLI.

**[Gitleaks](https://github.com/zricethezav/gitleaks)**

**What is Gitleaks?**

> Gitleaks is a SAST tool for detecting hardcoded secrets like passwords, api keys, and tokens in git repos.

Gitleaks is an amazing tool for secret leak prevention. If you haven’t implemented Gitleaks as a pre-commit checker, it’s worth your time to check it out.

**Why is Gitleaks relevant to Pillager?**

Pillager implements the powerful [rules](https://github.com/zricethezav/gitleaks#rules-summary) functionality of Gitleaks while taking a more offensive approach to working with the secrets found. While I have provided a baseline set of default rules, Pillager becomes much more powerful if you allow users to create rules for their own use-cases.

> This goes without saying but I’m going to say it anyways: I am **not** responsible for any repercussions caused by your use of pillager. This tool is intended for defensive, Blue Team use.

## GitHub:

> **[GitHub - brittonhayes/pillager: Pillage filesystems for sensitive information with...](https://github.com/brittonhayes/pillager)**
>
> Pillage filesystems for sensitive information with Go 🔍