StealedStealed Documentation
Open Stealed
API ReferenceInfostealer

The Windows environment variables of a machine

GET
/api/v1/machines/{machine_hash}/environment

The environment of ONE copy of the machine (the one with the most variables: copies report different environments, and a union would be one no machine ever had). Paginated, in the order the sheet sorts them (variable name); total_pages is at least 1, past the last page items is empty. Same access rule, anchor (hash, optional) and masking as the sheet GET /machines/{machine_hash}; the generated_at of a rubric read from the cached sheet is the build of that sheet, and two calls that answer the same one answer the same page. The value is returned for a short list of benign Windows variables only (masked false); every other variable is listed by name with value null and masked true, because a stolen environment holds API keys and passwords. masked filters on that flag, and total then counts the filtered rows. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. Every call is written to the access journal as machine.read. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.

Authorization

ApiKeyAuth
X-API-Key<token>

API key for authentication

In: header

Path Parameters

machine_hash*Machine Hash

The machine: any of its logs, as machine_hash of the list says (32 hex characters, any case).

Match^[0-9a-fA-F]{32}$

Query Parameters

hash?|

Optional: a credential of the tenant that is on this machine (32 hex characters, any case). Without it the server takes the smallest credential of the tenant on the machine itself and checks it exactly the same way; the machine is then open to the same people. With it, that credential is checked instead and anchors the machine: a credential that is not in the perimeter, or not on this machine, is refused (404) with no fallback to another.

page?Page

Page number, from 1. Past the last page items is empty.

Default1
Range1 <= value <= 1000000
page_size?Page Size

Rows per page, 200 at most.

Default50
Range1 <= value <= 200
masked?|

True: only the variables whose value is withheld; False: only those returned with their value.

Response Body

application/json

curl -X GET "https://api.stealed.io/api/v1/machines/string/environment"
{
  "total": 0,
  "page": 0,
  "page_size": 0,
  "total_pages": 0,
  "generated_at": "string",
  "items": [
    {
      "key": "string",
      "value": "string",
      "masked": true
    }
  ]
}
Empty
Empty
Empty
Empty
Empty

The processes that were running on a machine GET

The process names the stealer listed, with how many instances ran (across copies the most any one copy saw, never the sum). Paginated, in the order the sheet sorts them (most instances first, then name); `total_pages` is at least 1, past the last page `items` is empty. Same access rule, anchor (`hash`, optional) and masking as the sheet `GET /machines/{machine_hash}`; the `generated_at` of a rubric read from the cached sheet is the build of that sheet, and two calls that answer the same one answer the same page. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. Every call is written to the access journal as `machine.read`. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.