diff --git a/api-reference/leaks/export-leaks.mdx b/api-reference/leaks/export-leaks.mdx index ffa9b9ee..f410b322 100644 --- a/api-reference/leaks/export-leaks.mdx +++ b/api-reference/leaks/export-leaks.mdx @@ -4,7 +4,11 @@ openapi: post /v1/leaks/export ## Overview -Export leaked credentials data with the same filtering capabilities as the main leaks endpoint. Supports both JSON and CSV formats for easy integration with external tools and reporting systems. +Export leaked credentials data with filtering by type, domain, email, date range, and more. Supports both JSON and CSV formats for easy integration with external tools and reporting systems. + + +**Password Unmasking**: Passwords are displayed unmasked after [domain verification](/cloud/credential-monitoring#domain-verification). Without verification, passwords appear as `***MASKED***`. + ## Export Formats @@ -120,9 +124,9 @@ curl -X POST "https://api.projectdiscovery.io/v1/leaks/export" \ - CSV format is more efficient for large datasets ### Security Considerations -- Exported data may contain sensitive information +- Exported data may contain sensitive information including unmasked passwords - Ensure secure handling and storage of exported files -- Password unmasking follows the same ACL rules as the main leaks endpoint +- Passwords are unmasked after [domain verification](/cloud/credential-monitoring#domain-verification) ### Performance Tips - Use specific filters to reduce export size diff --git a/api-reference/leaks/get-all-leaks.mdx b/api-reference/leaks/get-all-leaks.mdx deleted file mode 100644 index d91ad5bf..00000000 --- a/api-reference/leaks/get-all-leaks.mdx +++ /dev/null @@ -1,140 +0,0 @@ ---- -openapi: get /v1/leaks ---- - - -This is the **new consolidated leaks endpoint** that replaces the deprecated individual endpoints (`/v1/leaks/domain`, `/v1/leaks/email`, `/v1/leaks/domain/customers`). - -It returns all types of leaks (personal, employee, customer) with optional filtering by type. - - -## Overview - -The consolidated leaks endpoint provides access to all leaked credentials associated with your account: - -- **Personal leaks**: Leaks associated with your personal email address -- **Employee leaks**: Leaks from employees of your verified domains, classified as: - - `organization_leaks`: Leaks on organization systems (login URL domain matches email domain) - - `external_vendor_leaks`: Leaks on external vendor systems (login URL domain differs from email domain) -- **Customer leaks**: Leaks from customers using your verified domains - -## Key Features - -### Advanced Filtering -- Filter by leak type (`personal`, `employee`, `customer`, `external_vendor_leaks`, `organization_leaks`) -- Search across all fields -- Filter by domain, email, status, and date ranges -- Sort by various fields (URL, username, log_date, country, etc.) - -### Grouping & Analytics -Use the `group_by` parameter to get aggregated data: -- Group by URL, country, device_ip, hostname, email, or hardware_id -- Returns group summaries instead of individual leak records -- Perfect for analytics and reporting - -### Pagination -- Standard pagination with `limit` and `page_number` parameters -- Default limit: 20 results per page - -## Response Structure - -### Individual Leaks Response -```json -{ - "data": [ - { - "id": "leak_id_hash", - "url": "https://example.com", - "username": "user@example.com", - "password": "masked_or_unmasked", - "device_ip": "192.168.1.1", - "hostname": "DESKTOP-ABC123", - "os": "Windows 10", - "country": "United States", - "log_date": "2023-01-15", - "hardware_id": "hw_12345", - "domain": "example.com", - "email_domain": "example.com", - "url_domain": "example.com", - "status": "open", - "user_type": "employee" - } - ], - "total_leaks": 150, - "total_pages": 8, - "total_count": 150, - "summary": { - "total_leaks": 150, - "personal_leaks": 25, - "employee_leaks": 100, - "customer_leaks": 25, - "external_vendor_leaks": 60, - "organization_leaks": 40 - } -} -``` - -### Grouped Response (when using `group_by`) -```json -{ - "group_summary": [ - { - "url": "https://facebook.com", - "count": 45 - }, - { - "url": "https://linkedin.com", - "count": 32 - } - ], - "total_leaks": 150 -} -``` - -## Privacy & Security - -### Access Control -- **Personal leaks**: Always accessible to the authenticated user -- **Employee/Customer leaks**: Requires domain verification -- **Password unmasking**: Requires domain verification - -### Data Classification -The API automatically classifies employee leaks: -- **Organization leaks**: Login URL domain matches or is a subdomain of the email domain -- **External vendor leaks**: Login URL domain is completely different from email domain - -## Migration from Deprecated Endpoints - -If you're currently using the deprecated endpoints, here's how to migrate: - -| Deprecated Endpoint | New Equivalent | -|-------------------|----------------| -| `GET /v1/leaks/email` | `GET /v1/leaks?type=personal` | -| `GET /v1/leaks/domain` | `GET /v1/leaks?type=employee` | -| `GET /v1/leaks/domain/customers` | `GET /v1/leaks?type=customer` | - -## Examples - -### Get all leaks -```bash -curl -X GET "https://api.projectdiscovery.io/v1/leaks" \ - -H "Authorization: Bearer YOUR_API_KEY" -``` - -### Get only employee leaks -```bash -curl -X GET "https://api.projectdiscovery.io/v1/leaks?type=employee" \ - -H "Authorization: Bearer YOUR_API_KEY" -``` - -### Get leaks grouped by URL -```bash -curl -X GET "https://api.projectdiscovery.io/v1/leaks?group_by=url" \ - -H "Authorization: Bearer YOUR_API_KEY" -``` - -### Search for specific domain -```bash -curl -X GET "https://api.projectdiscovery.io/v1/leaks?domain=example.com" \ - -H "Authorization: Bearer YOUR_API_KEY" -``` diff --git a/api-reference/leaks/get-domain-customer-leaks.mdx b/api-reference/leaks/get-domain-customer-leaks.mdx deleted file mode 100644 index f818a33b..00000000 --- a/api-reference/leaks/get-domain-customer-leaks.mdx +++ /dev/null @@ -1,47 +0,0 @@ ---- -openapi: get /v1/leaks/domain/customers ---- - - -**DEPRECATED:** This endpoint is deprecated in favor of the consolidated `/v1/leaks` endpoint. - -Use `GET /v1/leaks?type=customer` instead for the same functionality with enhanced features. - - -## Migration Guide - -This endpoint has been replaced by the new consolidated leaks API. Here's how to migrate: - -### Old Way (Deprecated) -```bash -GET /v1/leaks/domain/customers?search=example&limit=20 -``` - -### New Way (Recommended) -```bash -GET /v1/leaks?type=customer&search=example&limit=20 -``` - -## Why Migrate? - -The new consolidated endpoint offers several advantages: - -- **Unified API**: Access all leak types (personal, employee, customer) from one endpoint -- **Enhanced Privacy**: Better privacy controls for customer data -- **Advanced Filtering**: More sophisticated filtering and search capabilities -- **Improved Performance**: Optimized for better response times -- **Future-Proof**: All new features will be added to the consolidated endpoint -- **Better Analytics**: Enhanced grouping and summary capabilities - -## Privacy Enhancements - -The new consolidated endpoint includes enhanced privacy protections for customer leaks: - -- **Password Masking**: Customer leak passwords are never unmasked (privacy protection) -- **Access Control**: Stricter validation of domain ownership -- **Audit Logging**: Better tracking of access to customer data - -## See Also - -- [Get All Leaks (New Consolidated Endpoint)](/api-reference/leaks/get-all-leaks) -- [Migration Guide](#migration-guide) above \ No newline at end of file diff --git a/api-reference/leaks/get-domain-leaks.mdx b/api-reference/leaks/get-domain-leaks.mdx deleted file mode 100644 index 2f6d1499..00000000 --- a/api-reference/leaks/get-domain-leaks.mdx +++ /dev/null @@ -1,38 +0,0 @@ ---- -openapi: get /v1/leaks/domain ---- - - -**DEPRECATED:** This endpoint is deprecated in favor of the consolidated `/v1/leaks` endpoint. - -Use `GET /v1/leaks?type=employee` instead for the same functionality with enhanced features. - - -## Migration Guide - -This endpoint has been replaced by the new consolidated leaks API. Here's how to migrate: - -### Old Way (Deprecated) -```bash -GET /v1/leaks/domain?search=example&limit=20 -``` - -### New Way (Recommended) -```bash -GET /v1/leaks?type=employee&search=example&limit=20 -``` - -## Why Migrate? - -The new consolidated endpoint offers several advantages: - -- **Unified API**: Access all leak types (personal, employee, customer) from one endpoint -- **Enhanced Classification**: Distinguishes between organization leaks and external vendor leaks -- **Better Filtering**: More advanced filtering and grouping options -- **Improved Performance**: Optimized for better response times -- **Future-Proof**: All new features will be added to the consolidated endpoint - -## See Also - -- [Get All Leaks (New Consolidated Endpoint)](/api-reference/leaks/get-all-leaks) -- [Migration Guide](#migration-guide) above \ No newline at end of file diff --git a/api-reference/leaks/get-domain-stats.mdx b/api-reference/leaks/get-domain-stats.mdx index 46ef5d35..a8105724 100644 --- a/api-reference/leaks/get-domain-stats.mdx +++ b/api-reference/leaks/get-domain-stats.mdx @@ -4,10 +4,10 @@ openapi: get /v1/leaks/stats/domain ## Overview -Get statistical information about leaks associated with a specific domain. This endpoint provides aggregate data for monitoring and reporting purposes. +Get statistical information about leaks associated with any domain. This is a **public endpoint** that doesn't require authentication, making it ideal for quick breach checks and integrations. -This endpoint requires domain verification. You can only get stats for domains you have verified ownership of. +**Public Endpoint**: No authentication required. You can check leak statistics for any domain. ## Query Parameters @@ -15,7 +15,6 @@ This endpoint requires domain verification. You can only get stats for domains y | Parameter | Type | Description | |-----------|------|-------------| | `domain` | string | **Required.** The domain to get leak statistics for | -| `unmask_email` | boolean | Whether to unmask email addresses in the response | ## Response Structure @@ -25,12 +24,8 @@ The response provides comprehensive statistics about leaks for the specified dom { "domain": "example.com", "total_leaks": 150, - "open_leaks": 120, - "fixed_leaks": 30, - "leak_types": { - "employee_leaks": 100, - "customer_leaks": 50 - }, + "employee_leaks": 100, + "customer_leaks": 50, "recent_activity": { "last_30_days": 15, "last_7_days": 3 @@ -60,26 +55,28 @@ The response provides comprehensive statistics about leaks for the specified dom ## Usage Examples -### Get basic domain stats +### Check domain breach status ```bash -curl -X GET "https://api.projectdiscovery.io/v1/leaks/stats/domain?domain=example.com" \ - -H "Authorization: Bearer YOUR_API_KEY" +curl -X GET "https://api.projectdiscovery.io/v1/leaks/stats/domain?domain=example.com" ``` -### Get stats with unmasked emails -```bash -curl -X GET "https://api.projectdiscovery.io/v1/leaks/stats/domain?domain=example.com&unmask_email=true" \ - -H "Authorization: Bearer YOUR_API_KEY" -``` + +No API key or authentication header is required for this endpoint. + -## Best Practices +## Use Cases -### Regular Monitoring -- Check domain stats regularly to identify new leaks quickly -- Set up automated alerts when leak counts increase -- Monitor the ratio of open vs fixed leaks +### Quick Breach Check +Use this endpoint to quickly check if a domain has any known credential leaks without requiring authentication. + +### Security Integrations +Integrate with your security tools to monitor domains for new leaks and alert when breach counts increase. + +### Due Diligence +Check potential partners or vendors for credential exposure as part of your security assessment process. + +## Best Practices -### Performance Considerations -- Cache stats data appropriately to avoid excessive API calls -- Use this endpoint for summary data, detailed leak info requires other endpoints +- Cache results appropriately to avoid excessive API calls +- Use this for summary data; detailed leak information requires authenticated endpoints - Consider rate limiting when building automated monitoring systems diff --git a/api-reference/leaks/get-email-leaks.mdx b/api-reference/leaks/get-email-leaks.mdx deleted file mode 100644 index 9ae2607d..00000000 --- a/api-reference/leaks/get-email-leaks.mdx +++ /dev/null @@ -1,38 +0,0 @@ ---- -openapi: get /v1/leaks/email ---- - - -**DEPRECATED:** This endpoint is deprecated in favor of the consolidated `/v1/leaks` endpoint. - -Use `GET /v1/leaks?type=personal` instead for the same functionality with enhanced features. - - -## Migration Guide - -This endpoint has been replaced by the new consolidated leaks API. Here's how to migrate: - -### Old Way (Deprecated) -```bash -GET /v1/leaks/email?search=example&limit=20 -``` - -### New Way (Recommended) -```bash -GET /v1/leaks?type=personal&search=example&limit=20 -``` - -## Why Migrate? - -The new consolidated endpoint offers several advantages: - -- **Unified API**: Access all leak types (personal, employee, customer) from one endpoint -- **Enhanced Features**: Better filtering, grouping, and analytics capabilities -- **Improved Performance**: Optimized for better response times and reliability -- **Future-Proof**: All new features will be added to the consolidated endpoint -- **Better Integration**: Easier to build comprehensive security dashboards - -## See Also - -- [Get All Leaks (New Consolidated Endpoint)](/api-reference/leaks/get-all-leaks) -- [Migration Guide](#migration-guide) above \ No newline at end of file diff --git a/api-reference/leaks/get-email-stats.mdx b/api-reference/leaks/get-email-stats.mdx index 8b0703b1..eb8d3413 100644 --- a/api-reference/leaks/get-email-stats.mdx +++ b/api-reference/leaks/get-email-stats.mdx @@ -4,10 +4,10 @@ openapi: get /v1/leaks/stats/email ## Overview -Get statistical information about leaks associated with a specific email address. This endpoint provides aggregate data for personal leak monitoring and analysis. +Get statistical information about leaks associated with any email address. This is a **public endpoint** that doesn't require authentication, making it ideal for quick breach checks and self-service monitoring. -This endpoint is primarily used for personal email leak statistics. For organizational monitoring, consider using the domain stats endpoint instead. +**Public Endpoint**: No authentication required. You can check leak statistics for any email address. ## Query Parameters @@ -15,7 +15,6 @@ This endpoint is primarily used for personal email leak statistics. For organiza | Parameter | Type | Description | |-----------|------|-------------| | `email` | string | **Required.** The email address to get leak statistics for | -| `unmask_email` | boolean | Whether to unmask email addresses in the response | ## Response Structure @@ -25,8 +24,6 @@ The response provides comprehensive statistics about leaks for the specified ema { "email": "user@example.com", "total_leaks": 25, - "open_leaks": 18, - "fixed_leaks": 7, "leak_classification": { "personal_leaks": 15, "employee_leaks": 8, @@ -51,13 +48,11 @@ The response provides comprehensive statistics about leaks for the specified ema "risk_timeline": [ { "date": "2023-03", - "new_leaks": 3, - "fixed_leaks": 1 + "new_leaks": 3 }, { "date": "2023-02", - "new_leaks": 5, - "fixed_leaks": 2 + "new_leaks": 5 } ] } @@ -69,52 +64,36 @@ The response provides comprehensive statistics about leaks for the specified ema |-------|-------------| | `email` | The email address these statistics apply to | | `total_leaks` | Total number of leaks found for this email | -| `open_leaks` | Number of leaks that haven't been marked as fixed | -| `fixed_leaks` | Number of leaks marked as remediated | | `leak_classification` | Breakdown by leak type (personal, employee, customer) | | `recent_activity` | New leak discovery in recent time periods | | `compromised_services` | Services where this email was found in leaks | -| `risk_timeline` | Historical trend of leak discovery and remediation | +| `risk_timeline` | Historical trend of leak discovery | ## Usage Examples -### Get basic email stats +### Check email breach status ```bash -curl -X GET "https://api.projectdiscovery.io/v1/leaks/stats/email?email=user@example.com" \ - -H "Authorization: Bearer YOUR_API_KEY" +curl -X GET "https://api.projectdiscovery.io/v1/leaks/stats/email?email=user@example.com" ``` -### Get stats with unmasked emails -```bash -curl -X GET "https://api.projectdiscovery.io/v1/leaks/stats/email?email=user@example.com&unmask_email=true" \ - -H "Authorization: Bearer YOUR_API_KEY" -``` + +No API key or authentication header is required for this endpoint. + -## Privacy Considerations +## Use Cases -### Access Control -- You can only access stats for emails you're authorized to view -- Personal emails: accessible to the account owner -- Employee emails: requires domain verification +### Personal Breach Check +Allow users to quickly check if their email has been involved in any credential leaks. -### Data Sensitivity -- Email statistics may reveal sensitive information about user behavior -- Consider data retention policies for stored statistics -- Implement appropriate access controls in your applications +### Self-Service Monitoring +Build breach notification tools that let users check their own exposure without requiring account creation. -## Best Practices +### Security Awareness +Integrate into security training tools to show employees their personal exposure risk. -### Regular Monitoring -- Check email stats periodically for accounts under your management -- Set up alerts for new leak discoveries -- Track remediation progress to ensure security improvements - -### Integration Tips -- Use this endpoint for summary dashboards and reports -- Combine with detailed leak endpoints for comprehensive security monitoring -- Cache results appropriately to minimize API usage +## Best Practices -### Security Recommendations -- Encourage users to fix open leaks promptly -- Provide guidance on changing passwords for compromised services -- Monitor trends to identify systemic security issues +- Cache results appropriately to minimize API calls +- Use this for summary data; detailed leak information requires authenticated endpoints +- Consider rate limiting when building user-facing applications +- Combine with the domain stats endpoint for comprehensive organizational monitoring diff --git a/api-reference/leaks/get-leak-info.mdx b/api-reference/leaks/get-leak-info.mdx index 5a00661d..1edf6c4c 100644 --- a/api-reference/leaks/get-leak-info.mdx +++ b/api-reference/leaks/get-leak-info.mdx @@ -4,7 +4,11 @@ openapi: post /v1/leaks/info ## Overview -Retrieve detailed information for a specific leak by its ID. This endpoint provides access to complete leak details with optional password and email unmasking based on your permissions and domain verification. +Retrieve detailed information for a specific leak by its ID. This endpoint provides access to complete leak details including unmasked passwords after domain verification. + + +**Password Unmasking**: Passwords are displayed unmasked after [domain verification](/cloud/credential-monitoring#domain-verification). Without verification, passwords appear as `***MASKED***`. + ## Authentication & Authorization @@ -12,7 +16,6 @@ Retrieve detailed information for a specific leak by its ID. This endpoint provi - **Personal leaks**: Always accessible if the leak belongs to your email - **Employee/Customer leaks**: Requires domain verification for the associated domain - **Password unmasking**: Requires domain verification -- **Customer leak privacy**: Passwords are never unmasked for customer leaks (privacy protection) ### Leak ID Format The leak ID must be a 32-character MD5 hash (e.g., `b3652f2555841f7652badd9804859f4e`). @@ -98,14 +101,15 @@ The leak ID must be a 32-character MD5 hash (e.g., `b3652f2555841f7652badd980485 ## Password Unmasking Rules -### When Passwords Are Unmasked -- Personal leaks: Always unmasked for the account owner -- Employee leaks: Unmasked with domain verification -- Customer leaks: **Never unmasked** (privacy protection) +Passwords are unmasked after [domain verification](/cloud/credential-monitoring#domain-verification): + +| Leak Type | Password Access | +|-----------|-----------------| +| **Personal leaks** | Always unmasked for the account owner | +| **Employee leaks** | Unmasked after domain verification | +| **Customer leaks** | Unmasked after domain verification | -### When Passwords Are Masked -- Shows as `***MASKED***` when access is not authorized -- Customer leak passwords are always masked for privacy protection +Without domain verification, passwords show as `***MASKED***`. ## Usage Examples @@ -122,7 +126,6 @@ curl -X POST "https://api.projectdiscovery.io/v1/leaks/info" \ ## Security Considerations ### Privacy Protection -- Customer leak passwords are never exposed to maintain customer privacy - Access is strictly controlled based on domain verification - All access attempts are logged for security auditing diff --git a/cloud/credential-monitoring.mdx b/cloud/credential-monitoring.mdx index 28a0b86e..20526ea5 100644 --- a/cloud/credential-monitoring.mdx +++ b/cloud/credential-monitoring.mdx @@ -36,78 +36,200 @@ title="Try Credential Monitoring Now" | Feature | Free Users | Free Business Domain Users | Enterprise Users | | :------ | ---------- | -------------------------- | ---------------- | | Personal email exposures | ✓ | ✓ | ✓ | -| Organization-wide credential exposures | - | ✓ (Requires DNS verification) | ✓ | -| View employee passwords | - | ✓ (Requires DNS verification) | ✓ | +| Organization-wide credential exposures | ✗ | ✓ (Requires DNS verification) | ✓ | | Export data (JSON/CSV) | ✓ | ✓ | ✓ | | API access | ✓ | ✓ | ✓ | -| Multi-domain monitoring | - | - | ✓ | -| Priority support | - | - | ✓ | +| Multi-domain monitoring | ✗ | ✗ | ✓ | +| Priority support | ✗ | ✗ | ✓ | - -**Access Control**: Viewing employee passwords is only accessible to users with **Owner** or **Admin** account types within your organization. - +## Domain Verification -## Domain Verification (Required for Organization-Wide Leaks) + +**Required for Organization-Wide Leaks**: To access **Employee Leaks** and **Customer/User Leaks** for your organization, you must first verify ownership of your domain. + -To access **Employee Leaks** and **Customer/User Leaks** for your organization, you must first verify ownership of your domain using a DNS TXT record. +### How to Verify in the App + + + + Go to **Credential Monitoring → Domains → Add Domain** + + + Type your domain name and click **Continue** + + + Select your preferred method tab (DNS record / HTML meta tag / Upload TXT file) and follow the instructions. Use the built-in copy and download helpers. + + + After adding the record, meta tag, or file, click **Verify**. A successful verification marks the domain as **Verified** ✓ + + -### How to Verify Your Domain +--- -1. In **ProjectDiscovery Cloud**, open **Credential Monitoring → Domains**. -2. Click **Add Domain**, enter your business domain (for example: example.com), and click **Verify Now**. -3. A **DNS TXT record** will appear — copy this value. -4. Add the TXT record to your DNS configuration through your provider (e.g., Cloudflare, GoDaddy, Route53). -5. Wait a few minutes for DNS propagation. -6. Return to the dashboard and click **Verify** to complete the process. +### Verification Methods -When verification succeeds, your domain will show a ✅ Verified status in the list. +Choose from three verification methods based on your access level: -#### Example DNS TXT Record + + + Best when you have DNS access + + + Best when you can edit your website + + + Best when you can upload files to your site + + - Type: TXT - Host: _pd-verification.example.com - Value: pd-verification=2a9f34b8e6b74912adbe4f + +The verification modal in the app provides **copy/download helpers** for each method to make setup quick and easy. + -### Verifying Multiple Domains +--- -You can verify multiple domains from the same account. (Note: This feature requires an Enterprise subscription) -Each domain requires its own TXT record and verification step. +#### Method 1: DNS TXT Record -Example: -- example.com -- example.org -- brand-example.io + +**Recommended** — Standard method when you have access to edit DNS records for the domain. + -### Troubleshooting + + + Add a TXT record on the root of your domain with the following value: + + ``` + projectdiscovery-verification=YOUR_VERIFICATION_STRING + ``` + + + | Setting | Value | + |---------|-------| + | Host / Name | `@` (or "root" depending on your DNS provider) | + | Type | `TXT` | + | Value | `projectdiscovery-verification=YOUR_VERIFICATION_STRING` | + + + Click **Verify** in Credential Monitoring. Once successful, your domain will show as **Verified**. + + + + +- **DNS propagation** can take up to 48 hours, though most verifications succeed within minutes +- Verify your record is live using terminal: + +```bash +dig TXT yourdomain.com +``` -**No TXT record appears after clicking “Verify Now.”** -→ Your account email is not a business domain. Log in with your work email (for example: name@company.com). +Or for specific record names: -**I logged in with GitHub and can’t verify.** -→ Log out and sign in using your company email directly. +```bash +dig TXT _pd-verification.yourdomain.com +``` + -**Verification fails after adding the TXT record.** -→ Wait 5–10 minutes for DNS propagation, then retry. -→ You can check manually with: +--- - dig TXT yourdomain.com +#### Method 2: HTML Meta Tag -**Government (.gov), education (.edu), or regulated domains** -→ TXT verification works the same way. Use an official organization email to access full breach details. + +Best when you can edit and deploy your site's HTML but cannot change DNS settings. + -### FAQs About Verification + + + Place this meta tag inside the `` section of your root HTML page (`https://yourdomain/`): + + ```html + + ``` + + + Push the updated HTML to your live site. + + + Click **Verify** in Credential Monitoring. + + + + +Confirm the tag is present in the deployed page: + +```bash +curl -s https://yourdomain | grep projectdiscovery-verification +``` -**Do I need to verify to see personal leaks?** -No — personal leaks are automatically visible for the email you used to sign up. Verification is only required for organization-wide views. +If verification fails: +- Ensure the change is on the **live site** (not staging) +- Clear any CDN/cache that might be serving an old version + -**Can I verify multiple domains?** -Yes, each domain requires its own TXT record. +--- -**How long does verification take?** -Usually 5–10 minutes, depending on DNS propagation time. +#### Method 3: Upload TXT File -**Do I need to reverify later?** -No, once a domain is verified it remains linked unless the TXT record is removed. + +Best when you can upload static files to your site root but don't want to modify DNS or HTML. + + + + + Create a file named `pd-verification.txt` containing only your verification string: + + ``` + YOUR_VERIFICATION_STRING + ``` + + + Upload the file so it's accessible at `https://yourdomain/pd-verification.txt` + + + Click **Verify** in Credential Monitoring. + + + + +Confirm the file is reachable and contains the expected string: + +```bash +curl -s https://yourdomain/pd-verification.txt +``` + +If verification fails: +- Ensure the file is served over **HTTPS** +- Verify it's accessible at the exact root path + + +--- + +### Quick Troubleshooting Reference + +| Method | Command | Expected Result | +|--------|---------|-----------------| +| **DNS** | `dig TXT yourdomain.com` | Shows `projectdiscovery-verification=...` | +| **HTML** | `curl -s https://yourdomain \| grep projectdiscovery-verification` | Shows the meta tag in `` | +| **File** | `curl -s https://yourdomain/pd-verification.txt` | Shows the verification string | + +--- + +### FAQs About Verification + + + + No — personal leaks are automatically visible for the email you used to sign up. Verification is only required for organization-wide views. + + + Only **Enterprise customers** can have multiple domains verified. You can self-verify each domain individually or reach out to support for bulk verification. + + + Usually 5–10 minutes, depending on DNS propagation time. + + + No, once a domain is verified it remains linked unless the verification record is removed. + + ## How It Works @@ -221,7 +343,6 @@ flowchart TD - `buyer@outlook.com` with stored passwords for `shop.hooli.com` - **Exclusions**: Does not include employee emails (those are classified as Employee Leaks) - **Access**: Available to verified Business Domain Users and Enterprise customers -- **Privacy**: Email addresses shown, but passwords are never displayed to protect customer privacy ### Key Classification Distinction @@ -259,10 +380,6 @@ Our classification system uses advanced pattern matching and domain analysis to - **Duplicate Prevention**: Cross-category filtering ensures employee emails don't appear in customer leak categories - **False Positive Reduction**: Multiple validation layers minimize misclassification - -**Important**: Customer leak data shows email addresses for identification purposes but never displays actual passwords to maintain customer privacy and comply with data protection standards. - - ## Understanding Malware-Based Credential Theft ### How Malware Steals Credentials @@ -334,11 +451,13 @@ When leak sources are blank or incomplete: Access credential monitoring data programmatically: -- **Domain Leaks**: `GET /v1/leaks/domain` - Get all malware-exposed credentials for your monitored domains -- **Email Leaks**: `GET /v1/leaks/email` - Get credential exposures for specific email addresses -- **Customer Leaks**: `GET /v1/leaks/domain/customers` - Get customer email addresses (returns only email addresses of customers, not full credential exposures) +- **Export Leaks**: `POST /v1/leaks/export` - Export all leaked credentials (personal, employee, customer) with filtering options +- **Leak Details**: `POST /v1/leaks/info` - Get detailed information for a specific leak +- **Update Status**: `POST /v1/leaks/status` - Mark leaks as fixed or reopen them +- **Domain Stats**: `GET /v1/leaks/stats/domain` - Get leak statistics for any domain (public endpoint, no auth required) +- **Email Stats**: `GET /v1/leaks/stats/email` - Get leak statistics for any email (public endpoint, no auth required) -For detailed API documentation and usage examples, see the [API Reference](/api-reference/leaks/get-domain-leaks). +For detailed API documentation and usage examples, see the [API Reference](/api-reference/leaks/export-leaks). Integrate these API endpoints with your security tools to automatically trigger password resets and security reviews when new malware-based exposures are detected. @@ -350,7 +469,7 @@ Integrate these API endpoints with your security tools to automatically trigger A: No, credential visibility is restricted to Owner and Admin accounts only. This ensures sensitive breach data is only accessible to authorized personnel responsible for security. **Q: Why can't I see employee passwords?** -A: Business Domain Users can view employee passwords data after DNS verification. Only Enterprise customers can monitor multiple domains. Customer passwords are never displayed to any user tier to protect customer privacy. +A: Business Domain Users can view employee passwords data after DNS verification. Only Enterprise customers can monitor multiple domains. **Q: How do I view my personal leaked credentials?** A: You can automatically view all leaked credentials associated with the email address you used to sign up. Simply navigate to "My Leaks" to see any exposures linked to your personal email account - no additional verification required. diff --git a/mint.json b/mint.json index 81086ab1..3d9fb181 100644 --- a/mint.json +++ b/mint.json @@ -514,7 +514,6 @@ { "group": "Leaks", "pages": [ - "api-reference/leaks/get-all-leaks", "api-reference/leaks/export-leaks", "api-reference/leaks/get-leak-info", "api-reference/leaks/update-leak-status", diff --git a/openapi.yaml b/openapi.yaml index 2021f870..ba14c93b 100644 --- a/openapi.yaml +++ b/openapi.yaml @@ -10988,7 +10988,8 @@ paths: $ref: '#/components/requestBodies/AddCustomSeverityMappingRequest' /v1/leaks/stats/domain: get: - summary: Your GET endpoint for domain stats + summary: Get leak statistics for a domain (Public) + description: 'Public endpoint - no authentication required. Returns leak statistics for any domain including employee/customer leak counts, geographic distribution, and top compromised services.' tags: - leaks responses: @@ -11072,19 +11073,18 @@ paths: default: $ref: '#/components/responses/ErrorResponse' operationId: get-v1-leaks-stats-domain - description: get leaks stats for a domain + security: [] parameters: - schema: type: string in: query name: domain - - schema: - type: boolean - in: query - name: unmask_email + required: true + description: The domain to get leak statistics for /v1/leaks/stats/email: get: - summary: Your GET endpoint for email stats + summary: Get leak statistics for an email (Public) + description: 'Public endpoint - no authentication required. Returns leak statistics for any email address including leak classification, compromised services, and risk timeline.' tags: - leaks responses: @@ -11168,17 +11168,14 @@ paths: default: $ref: '#/components/responses/ErrorResponse' operationId: get-v1-leaks-stats-email - description: get leaks stats for an email + security: [] parameters: - schema: type: string in: query name: email - description: Email to get stats for - - schema: - type: boolean - in: query - name: unmask_email + description: The email address to get leak statistics for + required: true /v1/leaks: get: summary: Get all leaked credentials @@ -11410,7 +11407,7 @@ paths: /v1/leaks/export: post: summary: Export leaked credentials - description: Export leaked credentials with same filtering options as GET /v1/leaks + description: 'Export leaked credentials with filtering by type, domain, email, date range, and more. Passwords are unmasked after domain verification. See [Domain Verification](/cloud/credential-monitoring#domain-verification) for setup instructions.' tags: - export responses: @@ -11518,11 +11515,6 @@ paths: in: query name: format description: Export format (json or csv) - - schema: - type: string - in: header - name: X-Team-Id - description: 'Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/team' requestBody: required: true content: @@ -12941,8 +12933,10 @@ paths: type: string /v1/leaks/status: post: - summary: Your POST endpoint - tags: [] + summary: Update leak status + description: 'Mark leaks as fixed or reopen them. Requires authentication and domain verification for employee/customer leaks. See [Domain Verification](/cloud/credential-monitoring#domain-verification) for setup instructions.' + tags: + - leaks responses: '200': description: OK @@ -12997,7 +12991,7 @@ paths: /v1/leaks/info: post: summary: Get leak information by ID - description: Retrieve detailed leak information by leak ID with optional password and email unmasking + description: 'Retrieve detailed leak information by leak ID. Passwords are unmasked after domain verification. See [Domain Verification](/cloud/credential-monitoring#domain-verification) for setup instructions.' tags: - leaks operationId: post-v1-leaks-info diff --git a/tools/alterx/install.mdx b/tools/alterx/install.mdx index bdc8cc16..3767f16e 100644 --- a/tools/alterx/install.mdx +++ b/tools/alterx/install.mdx @@ -1,32 +1,11 @@ --- title: 'Redirecting...' description: 'This page has moved to /opensource/alterx/install' +redirect: /opensource/alterx/install --- -import { useEffect } from 'react'; - -export const RedirectComponent = () => { - useEffect(() => { - window.location.replace('/opensource/alterx/install'); - }, []); - - return null; -}; - - - # 🔄 Redirecting... You are being redirected to [/opensource/alterx/install](/opensource/alterx/install). If you are not automatically redirected, [click here](/opensource/alterx/install). - -