From 4588f4c92b0f16bf71883bdbb343d67543185fc7 Mon Sep 17 00:00:00 2001 From: kelvinBen Date: Fri, 27 Aug 2021 01:25:50 +0800 Subject: [PATCH] =?UTF-8?q?1.=20=E4=BF=AE=E5=A4=8DMAC=E4=B8=8B=E6=97=A0?= =?UTF-8?q?=E6=9D=83=E9=99=90=E5=88=A0=E9=99=A4=E6=96=87=E4=BB=B6=E7=9A=84?= =?UTF-8?q?=E9=97=AE=E9=A2=98=202.=20=E4=BF=AE=E5=A4=8DWEB=E9=A1=B5?= =?UTF-8?q?=E9=9D=A2=E6=A3=80=E6=B5=8B=E6=89=BE=E4=B8=8D=E5=88=B0=E6=96=87?= =?UTF-8?q?=E4=BB=B6=E8=B7=AF=E5=BE=84=E7=9A=84=E9=97=AE=E9=A2=98=203.=20?= =?UTF-8?q?=E4=BF=AE=E5=A4=8DWEB=E9=A1=B5=E9=9D=A2=E6=A3=80=E6=B5=8B?= =?UTF-8?q?=E6=89=BE=E4=B8=8D=E5=88=B0hashlib=E7=9A=84=E9=97=AE=E9=A2=98?= =?UTF-8?q?=204.=20=E6=96=B0=E5=A2=9EAK=E9=9B=86?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- config.py | 69 +++++++++++++++++++++++++++++++++++++++++++ libs/core/parses.py | 19 ++++++++---- libs/task/ios_task.py | 6 +++- libs/task/web_task.py | 3 +- 4 files changed, 90 insertions(+), 7 deletions(-) diff --git a/config.py b/config.py index 71852eb..43c5c55 100644 --- a/config.py +++ b/config.py @@ -52,6 +52,75 @@ filter_no = [ r'.*.amap.com', ] +# AK集合 +filter_ak_map = { + "Aliyun_OSS": [ + r'.*accessKeyId.*".*"', + r'.*accessKeySecret.*".*"', + r'.*secret.*".*"' + ], + "Amazon_AWS_Access_Key_ID": r"([^A-Z0-9]|^)(AKIA|A3T|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{12,}", + "Amazon_AWS_S3_Bucket": [ + r"//s3-[a-z0-9-]+\\.amazonaws\\.com/[a-z0-9._-]+", + r"//s3\\.amazonaws\\.com/[a-z0-9._-]+", + r"[a-z0-9.-]+\\.s3-[a-z0-9-]\\.amazonaws\\.com", + r"[a-z0-9.-]+\\.s3-website[.-](eu|ap|us|ca|sa|cn)", + r"[a-z0-9.-]+\\.s3\\.amazonaws\\.com", + r"amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" + ], + "Artifactory_API_Token": r"(?:\\s|=|:|\"|^)AKC[a-zA-Z0-9]{10,}", + "Artifactory_Password": r"(?:\\s|=|:|\"|^)AP[\\dABCDEF][a-zA-Z0-9]{8,}", + "Authorization_Basic": r"basic\\s[a-zA-Z0-9_\\-:\\.=]+", + "Authorization_Bearer": r"bearer\\s[a-zA-Z0-9_\\-:\\.=]+", + "AWS_API_Key": r"AKIA[0-9A-Z]{16}", + "Basic_Auth_Credentials": r"(?<=:\/\/)[a-zA-Z0-9]+:[a-zA-Z0-9]+@[a-zA-Z0-9]+\\.[a-zA-Z]+", + "Cloudinary_Basic_Auth": r"cloudinary:\/\/[0-9]{15}:[0-9A-Za-z]+@[a-z]+", + "DEFCON_CTF_Flag": r"O{3}\\{.*\\}", + "Discord_BOT_Token": r"((?:N|M|O)[a-zA-Z0-9]{23}\\.[a-zA-Z0-9-_]{6}\\.[a-zA-Z0-9-_]{27})$", + "Facebook_Access_Token": r"EAACEdEose0cBA[0-9A-Za-z]+", + "Facebook_ClientID": r"[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K](.{0,20})?['\"][0-9]{13,17}", + "Facebook_OAuth": r"[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K].*['|\"][0-9a-f]{32}['|\"]", + "Facebook_Secret_Key": r"([f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K]|[f|F][b|B])(.{0,20})?['\"][0-9a-f]{32}", + "Firebase": r"[a-z0-9.-]+\\.firebaseio\\.com", + "Generic_API_Key": r"[a|A][p|P][i|I][_]?[k|K][e|E][y|Y].*['|\"][0-9a-zA-Z]{32,45}['|\"]", + "Generic_Secret": r"[s|S][e|E][c|C][r|R][e|E][t|T].*['|\"][0-9a-zA-Z]{32,45}['|\"]", + "GitHub": r"[g|G][i|I][t|T][h|H][u|U][b|B].*['|\"][0-9a-zA-Z]{35,40}['|\"]", + "GitHub_Access_Token": r"([a-zA-Z0-9_-]*:[a-zA-Z0-9_-]+@github.com*)$", + "Google_API_Key": r"AIza[0-9A-Za-z\\-_]{35}", + "Google_Cloud_Platform_OAuth": r"[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com", + "Google_Cloud_Platform_Service_Account": r"\"type\": \"service_account\"", + "Google_OAuth_Access_Token": r"ya29\\.[0-9A-Za-z\\-_]+", + "HackerOne_CTF_Flag": r"[h|H]1(?:[c|C][t|T][f|F])?\\{.*\\}", + "HackTheBox_CTF_Flag": r"[h|H](?:[a|A][c|C][k|K][t|T][h|H][e|E][b|B][o|O][x|X]|[t|T][b|B])\\{.*\\}$", + "Heroku_API_Key": r"[h|H][e|E][r|R][o|O][k|K][u|U].*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}", + "IP_Address": r"(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])", + "JSON_Web_Token": r"(?i)^((?=.*[a-z])(?=.*[0-9])(?:[a-z0-9_=]+\\.){2}(?:[a-z0-9_\\-\\+\/=]*))$", + "LinkFinder": r"(?:\"|')(((?:[a-zA-Z]{1,10}:\/\/|\/\/)[^\"'\/]{1,}\\.[a-zA-Z]{2,}[^\"']{0,})|((?:\/|\\.\\.\/|\\.\/)[^\"'><,;| *()(%%$^\/\\\\\\[\\]][^\"'><,;|()]{1,})|([a-zA-Z0-9_\\-\/]{1,}\/[a-zA-Z0-9_\\-\/]{1,}\\.(?:[a-zA-Z]{1,4}|action)(?:[\\?|#][^\"|']{0,}|))|([a-zA-Z0-9_\\-\/]{1,}\/[a-zA-Z0-9_\\-\/]{3,}(?:[\\?|#][^\"|']{0,}|))|([a-zA-Z0-9_\\-]{1,}\\.(?:php|asp|aspx|jsp|json|action|html|js|txt|xml)(?:[\\?|#][^\"|']{0,}|)))(?:\"|')", + "Mac_Address": r"(([0-9A-Fa-f]{2}[:]){5}[0-9A-Fa-f]{2}|([0-9A-Fa-f]{2}[-]){5}[0-9A-Fa-f]{2}|([0-9A-Fa-f]{4}[\\.]){2}[0-9A-Fa-f]{4})$", + "MailChimp_API_Key": r"[0-9a-f]{32}-us[0-9]{1,2}", + "Mailgun_API_Key": r"key-[0-9a-zA-Z]{32}", + "Mailto": r"(?<=mailto:)[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\.[a-zA-Z0-9.-]+", + "Password_in_URL": r"[a-zA-Z]{3,10}://[^/\\s:@]{3,20}:[^/\\s:@]{3,20}@.{1,100}[\"'\\s]", + "PayPal_Braintree_Access_Token": r"access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}", + "PGP_private_key_block": r"-----BEGIN PGP PRIVATE KEY BLOCK-----", + "Picatic_API_Key": r"sk_live_[0-9a-z]{32}", + "RSA_Private_Key": r"-----BEGIN RSA PRIVATE KEY-----", + "Slack_Token": r"(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})", + "Slack_Webhook": r"https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}", + "Square_Access_Token": r"sq0atp-[0-9A-Za-z\\-_]{22}", + "Square_OAuth_Secret": r"sq0csp-[0-9A-Za-z\\-_]{43}", + "SSH_DSA_Private_Key": r"-----BEGIN DSA PRIVATE KEY-----", + "SSH_EC_Private_Key": r"-----BEGIN EC PRIVATE KEY-----", + "Stripe_API_Key": r"sk_live_[0-9a-zA-Z]{24}", + "Stripe_Restricted_API_Key": r"rk_live_[0-9a-zA-Z]{24}", + "TryHackMe_CTF_Flag": r"[t|T](?:[r|R][y|Y][h|H][a|A][c|C][k|K][m|M][e|E]|[h|H][m|M])\\{.*\\}$", + "Twilio_API_Key": r"SK[0-9a-fA-F]{32}", + "Twitter_Access_Token": r"[t|T][w|W][i|I][t|T][t|T][e|E][r|R].*[1-9][0-9]+-[0-9a-zA-Z]{40}", + "Twitter_ClientID": r"[t|T][w|W][i|I][t|T][t|T][e|E][r|R](.{0,20})?['\"][0-9a-z]{18,25}", + "Twitter_OAuth": r"[t|T][w|W][i|I][t|T][t|T][e|E][r|R].*['|\"][0-9a-zA-Z]{35,44}['|\"]", + "Twitter_Secret_Key": r"[t|T][w|W][i|I][t|T][t|T][e|E][r|R](.{0,20})?['\"][0-9a-z]{35,44}" +} + # 此处配置壳信息 shell_list =[ 'com.stub.StubApp', diff --git a/libs/core/parses.py b/libs/core/parses.py index 8ce73af..1afd660 100644 --- a/libs/core/parses.py +++ b/libs/core/parses.py @@ -56,15 +56,24 @@ class ParsesThreads(threading.Thread): # 搜素AK和SK信息 if not ".js" == file_path[-3:]: - akAndSkList = re.compile(r'.*accessKeyId.*".*"|.*accessKeySecret.*".*"|.*secret.*".*"').findall(file_content) - for akAndSk in akAndSkList: - self.result_list.append(akAndSk.strip()) - print("[+] AK or SK in:",akAndSk.strip()) + for key,values in config.filter_ak_map.items(): + if isinstance(values,list): + for value in values: + self.__ak_and_sk__(key, value, file_content) + else: + self.__ak_and_sk__(key, values, file_content) # 遍历所有的字符串 for result in set(results): self.__parse_string__(result) - + + def __ak_and_sk__(self, name, ak_rule,content): + akAndSkList = re.compile(ak_rule).findall(content) + for akAndSk in akAndSkList: + ak = ("[%s]-->:%s") % (name,akAndSk.strip()) + self.result_list.append(ak) + print("[+] [%s] AK or SK in %s:") % (name, akAndSk.strip()) + def __parse_string__(self,result): # 通过正则筛选需要过滤的字符串 for filter_str in config.filter_strs: diff --git a/libs/task/ios_task.py b/libs/task/ios_task.py index 0262239..305e626 100644 --- a/libs/task/ios_task.py +++ b/libs/task/ios_task.py @@ -117,7 +117,11 @@ class iOSTask(object): os.makedirs(dir_path) shutil.move(old_ext_path, new_ext_path) if os.path.exists(old_ext_path): - os.remove(old_ext_path) + try: + # mac发生权限问题的时候做处理 + os.remove(old_ext_path) + except Exception: + shutil.rmtree(old_ext_path) def __get_parse_dir__(self,output_path,file_path): diff --git a/libs/task/web_task.py b/libs/task/web_task.py index 4bd8018..b028cb6 100644 --- a/libs/task/web_task.py +++ b/libs/task/web_task.py @@ -4,6 +4,7 @@ # Github: https://github.com/kelvinBen/AppInfoScanner import os import config +import hashlib from queue import Queue class WebTask(object): @@ -39,7 +40,7 @@ class WebTask(object): else: if len(dir_file.split("."))>1: if dir_file.split(".")[-1] in file_suffix: - with open(file_path,'rb') as f: + with open(dir_file_path,'rb') as f: dex_md5 = str(hashlib.md5().update(f.read()).hexdigest()).upper() self.file_identifier.append(dex_md5) self.file_queue.put(dir_file_path) \ No newline at end of file