Tips and Tricks | Search Cheatsheet

Search by regex for facebook credentials, http urls, darknet and onion urls, leaked passwords and much more

Facebook Leaks

Facebook Passwords are many times uploaded with phone numbers instead of an mail address and there is alot of leaks from east, for find those passwords fast you can try something like below command for a good result:

grep -ire -A2 \
  'Facebook.*[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' 

IPv4 Addresses

grep -roE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'

Http(s) urls

Example 1Example 2Example 3

grep -rEio '(ftp|ftps|http|https)://[^/"]+'

 grep -rEio "(ftp|ftps|http|https)://[a-zA-Z0-9./?=_-]*" \
 |sort \
 |uniq

grep -rEio  "https\*://"

Darknet

grep -rEo '.*[.]onion$' 

File Extension

.pngjpgjpe + jpegziprar

grep -rioE '(http|https)://(.*).png' 

grep -rioE '(http|https)://(.*).jpg' 

egrep -rio 'http.*[.]jpe?g'

egrep -rio 'http.*[.]zip'

egrep -rio 'http.*[.]rar'

Password(s)

Mostly leaked passwords has been leaked with the following format 'mail@mail.com:passwd', use below command to grab them

grep -HiEhr -o -e "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b:...*" | grep '\S'

Resource(s)

• <>