🔍 TraceLess - Real-Time Process Exposure Detector

The first tool that instantly tells you: "What sensitive data is being exposed right now by any process on this machine?"

🎯 What Makes TraceLess Revolutionary?

Every security scanner in the world checks:

• ✅ Ports
• ✅ CVEs
• ✅ Configuration files
• ✅ Filesystem

But NO ONE checks:

What secrets can be extracted immediately by an attacker who gets ANY access (even low-privileged)?

This is exactly how real breaches happen. An attacker gets limited access and immediately extracts credentials from running processes.

🚀 Key Features

• Zero Installation Footprint - Single binary, no dependencies
• Non-Destructive - Read-only operations, safe for production
• Real-Time Detection - Scans live processes instantly
• Comprehensive Coverage - 20+ secret patterns, privilege checks, network exposure
• Clean Output - Human-readable reports with remediation advice
• JSON Support - Machine-readable output for automation

🔬 What TraceLess Detects

1. Environment Variable Exposures

• Database passwords (DB_PASSWORD, MYSQL_PASSWORD)
• Cloud credentials (AWS, Azure, GCP)
• API keys and tokens
• JWT signing secrets
• OAuth client secrets
• SMTP credentials
• Service-specific tokens (GitHub, Slack, Stripe)

2. Command Line Exposures

• Database connection strings with embedded credentials
• Passwords passed as CLI arguments
• Bearer tokens in curl commands
• API keys in URLs
• Git operations with credentials
• Docker commands with secrets

3. Privilege Issues

• Processes running as root unnecessarily
• Elevated privileges on user applications

4. Network Exposures

• Services binding to all interfaces (0.0.0.0)
• Unnecessary public exposure

📦 Installation

Prerequisites

• Go 1.21 or higher (for building from source)
• Linux OS (primary support)
• Windows support (partial)

Build from Source

# Clone or download the source
cd traceless

# Build the binary
go build -o traceless

# Optional: Install system-wide
sudo mv traceless /usr/local/bin/

Quick Build Script

# Build for current platform
go build -ldflags "-s -w" -o traceless

# Build for Linux (from any platform)
GOOS=linux GOARCH=amd64 go build -ldflags "-s -w" -o traceless-linux

# Build for multiple platforms
./build.sh

🎮 Usage

⚠️ IMPORTANT: Authorization Required

TraceLess requires explicit authorization acknowledgment:

export TRACELESS_AUTHORIZED=yes

This confirms you have permission to scan the target system.

Basic Scan

# Scan all processes
./traceless

# Scan specific PID
./traceless -pid 1234

# Verbose output
./traceless -v

# JSON output for automation
./traceless -json > report.json

Example Output

╔════════════════════════════════════════════════════════════════╗
║                        TraceLess v1.0.0                        ║
║          Real-Time Process Exposure Detection Tool            ║
╚════════════════════════════════════════════════════════════════╝

⚠️  AUTHORIZATION REQUIRED ⚠️
This tool is for AUTHORIZED security testing only

🔍 Starting process exposure scan...

╔════════════════════════════════════════════════════════════════╗
║ EXPOSURE #1                                                    ║
╚════════════════════════════════════════════════════════════════╝

🔴 Severity: CRITICAL
📦 Process:  node (PID: 12345)
🔍 Type:     ENVIRONMENT_VARIABLE
📋 Issue:    Database password exposed in environment variable

💾 Value:    DB_P***REDACTED***word
🔬 Evidence:
   DB_PASSWORD=secr***REDACTED***1234

💡 Remediation:
   Use secure secret management (Vault, AWS Secrets Manager, etc.)
   Never pass secrets via environment variables in production

🛡️ Authorized Use Cases

TraceLess is designed for:

✅ Security Auditing - Assess your own systems for credential exposure ✅ Penetration Testing - Authorized security assessments with proper engagement letters ✅ DevSecOps - CI/CD pipeline security checks ✅ Security Hardening - Find and fix misconfigurations before attackers do ✅ Compliance Audits - Verify secrets management practices ✅ CTF Challenges - Competitive security exercises ✅ Security Research - Academic and professional security research ✅ Education - Learning about process security

❌ Unauthorized Use is Illegal - Never run this tool without permission

🏗️ Architecture

TraceLess is a lightweight scanner that:

1. Enumerates Processes - Reads /proc/ to find all running PIDs
2. Safe Metadata Collection - Reads only non-destructive files:
   • /proc/<pid>/environ - Environment variables
   • /proc/<pid>/cmdline - Command line arguments
   • /proc/<pid>/status - Process status and privileges
   • /proc/<pid>/comm - Process name
3. Pattern Matching - Applies 30+ detection rules
4. Risk Assessment - Assigns severity levels (CRITICAL/HIGH/MEDIUM/LOW)
5. Actionable Reporting - Provides specific remediation guidance

🔧 Configuration

TraceLess is zero-config by default, but you can customize detection:

Adding Custom Patterns

Edit patterns.go to add custom secret patterns:

{
    Name:        "CUSTOM_SECRET",
    Description: "Custom application secret exposed",
    Severity:    "HIGH",
    KeyPattern:  regexp.MustCompile(`(?i)MY_APP.*SECRET`),
    ValueCheck:  isNonEmpty,
}

Environment Variables

• TRACELESS_AUTHORIZED=yes - Required authorization acknowledgment

📊 Exit Codes

• 0 - No exposures found (clean system)
• 1 - Exposures detected or scan error

🔐 Security Considerations

Running TraceLess

• Requires appropriate permissions to read /proc/
• Does NOT require root for most scans
• May need elevated privileges to scan all processes
• Read-only operations - cannot modify processes

What TraceLess Does NOT Do

• ❌ Does not scan files or filesystem
• ❌ Does not modify any processes
• ❌ Does not kill or interfere with running processes
• ❌ Does not perform network scanning
• ❌ Does not exploit vulnerabilities

🤝 Contributing

Contributions welcome! Please:

1. Fork the repository
2. Create a feature branch
3. Add tests for new patterns
4. Submit a pull request

📝 License

MIT License - See LICENSE file for details

⚖️ Legal Notice

IMPORTANT: This tool is for authorized security testing only.

• You must have explicit permission to scan any system
• Unauthorized access to computer systems is illegal
• Users are responsible for compliance with all applicable laws
• The authors assume no liability for misuse

By using TraceLess, you agree to:

• Only scan systems you own or have written authorization to test
• Comply with all applicable laws and regulations
• Use the tool responsibly and ethically

🙏 Credits

Created for defensive security and authorized security testing.

Inspired by real-world breach techniques where attackers extract credentials from running processes.

📚 References

• OWASP Secrets Management
• CWE-200: Exposure of Sensitive Information
• NIST SP 800-53: Access Control

🐛 Reporting Issues

Found a bug or have a feature request?

• Open an issue on GitHub
• Provide OS version, Go version, and reproduction steps
• For security vulnerabilities, please report privately

🎓 Educational Use

TraceLess is an excellent tool for learning about:

• Process security on Linux
• Secrets management best practices
• Common credential exposure patterns
• Defensive security techniques
• Security auditing methodologies

---

Remember: With great power comes great responsibility. Use TraceLess ethically and legally.