blueflower

[Nytro]

blueflower

blueflower is a simple tool that looks for secrets such as private keys or passwords in a file structure. Interesting files are detected using heuristics on their names and on their content.

Unlike some forensics tools, blueflower does not search in RAM, and does not attempt to identify cryptographic keys or algorithms in binaries.

DISCLAIMER: This program is under development. It may not work as expected and it may destroy your computer. Use at your own risk.

Features

• multithreading
  
• detection of various key and password containers (SSH, Apple keychain, Java KeyStore, etc.) and other interesting files (Bitcoin wallets, PGP policies, etc.)
  
• detection of encrypted containers (Truecrypt, PGP Disks, GnuPG files, etc.)
  
• search in the content of the following types of files:
  
  • text/* MIME-typed files
    
  • archives RAR, tar, ZIP
    
  • compressed files bzip2, gzip
    
  • encrypted containers/archives: PGP/GPG, Truecrypt, RAR, ZIP
    
  • PDF documents
    

  [*]support of nested archives and compressed files (except for nested RARs)

  [*]portable *nix/Windows

  [*]CSV output

Sursa: https://github.com/veorq/blueflower