I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing.

Currently i'm doing this manually with the usual tools like grep and some terrible reg-ex but a nice stand-alone application would be ideal. Especially something i can use the output of and drop in a report. If i query the files from a terminal looking for card-numbers, it spits them back out, which also means i have to redact them. Ideally I need a count and a list of 'anonymized card numbers' as well as which files they were in.

Any suggestions on alternate ways of finding this data or tools that can be used to achieve this would be most welcome.

  • Similar to this question -- security.stackexchange.com/questions/34902/… ?
    – atdre
    Feb 28 '15 at 18:18
  • I'm voting to close this question because it's only attracted worthless one-liner “use this product its great” (or “use this product its crap”!) answers. The question could probably be salvaged by an edit, but as it's already asking about methodology and not about tools, I'm at a loss as to how to edit it to get useful answers. Jun 29 '15 at 22:08

ccsrch is a tool for exactly this purpose. I have seen QSAs use this as part of their audits.

Personally, I'm not fond of it. I've run it against a file with 100k cards and it found all 50k of them. I got better hit rates with a python script I threw together in an afternoon. And the output requires lots of manual review to weed out false positives.

But, again, QSAs use it, and it's better than nothing.

  • Thanks! Looks like its useful enough for what i'm doing right now. Has happily pulled 80k cards in a few short seconds from my test files. Pity it doesn't have an option to redact the output... :( None-the-less! Really appreciate the speedy answer as well!! Also, Disclaimer: I'm not a QSA!
    – NULLZ
    Feb 28 '15 at 15:41

From what I understand, you can find the data you need with tools like grep, but you are finding it difficult to deal with the resulting output because it, too, becomes sensitive data.

It appears that you need sed with your grep. Once you find offending data, you can pipe the result through a substitution process to create obfuscated card numbers.

But I'm not sure why you need to capture the card numbers at all. Grepping so that you know what files contain offending data should be enough, you can check for valid results by hand.

As for other PII, you are going to have to live with regex so that it meets your expected results. You can find other people's attempts at regex patterns to help you out.

Yes, you can get a variety of tools to help, but they all perform some form of grep|sed|awk and regex.


There is a paid product called Identity Finder that will do just that. It can find a variety of PII, and produces a report that you can use. I am not affiliated with this product, I just use it at work.


OpenDLP is another project widely touted -- http://opendlp.googlecode.com -- Another is MyDLP -- https://en.wikipedia.org/wiki/MyDLP


I've had an auditor recommend Cornell Spider, which is just a hacked together tool that uses some regexp to look for things like SSN, PAN, etc... It works but isn't very polished.


QuaSAr is a "for pay" product designed to do just this.

Disclaimer: I do not, nor have ever worked for confide, but have friends in the company.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.