WRAITH is a credential exposure monitoring tool for red teams and security researchers. It monitors paste sites and breach databases for exposed credentials tied to target domains — aggregating results from HIBP, DeHashed, IntelX, Pastebin, and GitHub, then alerting via Email, Slack, or Discord on new hits.

• 🔍 Multi-source monitoring — HIBP, DeHashed, IntelX, Pastebin, GitHub
• 🔗 Domain-scoped targeting — watch specific domains for credential exposure
• 🧠 Correlation engine — deduplicates and links findings across sources
• 📊 Historical database — SQLite (dev) / PostgreSQL (prod) via SQLAlchemy
• 🚨 Real-time alerting — Email (SMTP), Slack webhook, Discord webhook
• 🖥️ Web dashboard — dark theme SPA with findings table, source status, alert feed
• 📁 Export — JSON, CSV, rich terminal table output
• ⚙️ Background monitoring — daemon mode with configurable scan intervals

git clone https://github.com/xdrew87/wraith.git
cd wraith
py -m pip install -r requirements.txt
cp .env.example .env
# Edit .env with your API keys

Edit config.yaml for defaults, or set environment variables to override.

# Initialize the database
py src/main.py init

# Scan a domain once
py src/main.py scan example.com

# Scan an email address
py src/main.py scan user@example.com

# Add domain to watch list (continuous monitoring)
py src/main.py watch example.com

# Remove from watch list
py src/main.py unwatch example.com

# Show recent findings
py src/main.py report --format table
py src/main.py report --format json --output results.json

# Show alerts
py src/main.py alerts

# Launch web dashboard
py src/main.py dashboard --port 5050

py src/main.py dashboard --port 5050
# Open http://localhost:5050

Dashboard shows: live findings table, source status, alert feed, exposure stats.

Target: example.com
─────────────────────────────────────────────────────────
Source        Type       Value                  Severity
─────────────────────────────────────────────────────────
HIBP          Email      admin@example.com      HIGH
DeHashed      Password   p@ssw0rd123 (hash)     CRITICAL
IntelX        Paste      API key in paste       HIGH
GitHub        Secret     token in public repo   CRITICAL
Pastebin      Email      dev@example.com        MEDIUM
─────────────────────────────────────────────────────────
5 findings | 2 CRITICAL | 2 HIGH | 1 MEDIUM

WRAITH is intended strictly for:

• Authorized security assessments
• Defensive monitoring of domains you own or are authorized to test
• Security research in lab environments

Unauthorized use against systems or domains you do not own or have explicit permission to monitor is strictly prohibited.

MIT © 2026 xdrew87