bee-san/pyWhat

Health v2 · maintenance only

Adoption not part of the score

7313 stars · 391 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

pyWhat is a Python CLI tool that identifies what arbitrary text, files, or pcap network captures contain - emails, IP addresses, API keys, cryptocurrency addresses, and more. It recursively scans input using a large library of regex signatures and reports what each match is.

Use cases

• identify what a mysterious string or hex blob is
• extract emails, URLs, and credit card numbers from a pcap file
• find leaked API keys and credentials in GitHub repositories
• analyze malware samples for hardcoded domains
• scan text for bug bounty findings like webhooks and keys
• identify hashes, cryptocurrency addresses, and identifiers in CTF challenges

When to choose

• you need to quickly identify unknown strings, files, or network captures
• you want to extract sensitive data like keys and PII from text or pcaps
• you're doing CTF, OSINT, or malware triage work from the command line

When to avoid

• you need deep static or dynamic malware analysis rather than pattern identification
• you need a GUI-based forensic suite
• you need guaranteed-accurate detection rather than regex-based heuristics

Facets

cli-tool · maturity maintenance

security parser search-engine developer-tools security penetration-testing osint developer-tools python cli cross-platform windows osint ctf malware-analysis pcap-analysis identifier regex-matching bug-bounty command-line macos linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="bee-san/pyWhat")