Google Drive Hunter: Building the Tool Google Should’ve Built (Ayman Elsawah)
summary
Open-source tool Sleuthther (formerly Google Drive Hunter) scans every Google Workspace user via Directory and Drive APIs, exports per-user sheets with direct file links, and flags externally shared files; it defaults to dry run mode and requires enabling three APIs while minimizing scopes for least-privilege. The CLI can optionally revoke shares (drive scope required), the author built a web UI, plans AI classification to avoid human exposure, and a real incident uncovered a reused onboarding file turned into a public recommendation letter.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker intro
- 1:04Problem with shared drive files
- 4:09Why Google Drive Hunter was built
- 7:43Building the tool and API challenges
- 10:10Tool requirements and permissions
- 12:59Tool features and future plans
- 14:23Live demo of Sleuthther
- 15:34Unexpected file discovery story
- 18:43Future AI and security enhancements
- 20:53Closing and Q&A session
related talks
22mGDIOCSpider: Extracting and Identifying IOCs from the GDriveverse
48mThe Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
52mThe Dark Underbelly of 3rd-Party Application Access to Corporate Data
22mThe Silent Breach: Security Threats in Google Workspace
28mHow I Could Have Stolen Your Photos From Google
34mGoogle Hacking: The Amazing Next Door
39mBye-Bye DIY: Frictionless Security Operations with Google
40mOne Drive, Double Agent: Clouded OneDrive Turns Sides