1. 修复MAC下无权限删除文件的问题

2. 修复WEB页面检测找不到文件路径的问题
3. 修复WEB页面检测找不到hashlib的问题
4. 新增AK集

config.py

@@ -52,6 +52,75 @@ filter_no = [
     r'.*.amap.com',
 ]
 
+# AK集合
+filter_ak_map = {
+    "Aliyun_OSS": [
+        r'.*accessKeyId.*".*"',
+        r'.*accessKeySecret.*".*"',
+        r'.*secret.*".*"'
+    ],
+    "Amazon_AWS_Access_Key_ID": r"([^A-Z0-9]|^)(AKIA|A3T|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{12,}",
+	"Amazon_AWS_S3_Bucket": [
+		r"//s3-[a-z0-9-]+\\.amazonaws\\.com/[a-z0-9._-]+",
+		r"//s3\\.amazonaws\\.com/[a-z0-9._-]+",
+		r"[a-z0-9.-]+\\.s3-[a-z0-9-]\\.amazonaws\\.com",
+		r"[a-z0-9.-]+\\.s3-website[.-](eu|ap|us|ca|sa|cn)",
+		r"[a-z0-9.-]+\\.s3\\.amazonaws\\.com",
+		r"amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+	],
+	"Artifactory_API_Token": r"(?:\\s|=|:|\"|^)AKC[a-zA-Z0-9]{10,}",
+	"Artifactory_Password": r"(?:\\s|=|:|\"|^)AP[\\dABCDEF][a-zA-Z0-9]{8,}",
+	"Authorization_Basic": r"basic\\s[a-zA-Z0-9_\\-:\\.=]+",
+	"Authorization_Bearer": r"bearer\\s[a-zA-Z0-9_\\-:\\.=]+",
+	"AWS_API_Key": r"AKIA[0-9A-Z]{16}",
+	"Basic_Auth_Credentials": r"(?<=:\/\/)[a-zA-Z0-9]+:[a-zA-Z0-9]+@[a-zA-Z0-9]+\\.[a-zA-Z]+",
+	"Cloudinary_Basic_Auth": r"cloudinary:\/\/[0-9]{15}:[0-9A-Za-z]+@[a-z]+",
+	"DEFCON_CTF_Flag": r"O{3}\\{.*\\}",
+	"Discord_BOT_Token": r"((?:N|M|O)[a-zA-Z0-9]{23}\\.[a-zA-Z0-9-_]{6}\\.[a-zA-Z0-9-_]{27})$",
+	"Facebook_Access_Token": r"EAACEdEose0cBA[0-9A-Za-z]+",
+	"Facebook_ClientID": r"[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K](.{0,20})?['\"][0-9]{13,17}",
+	"Facebook_OAuth": r"[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K].*['|\"][0-9a-f]{32}['|\"]",
+	"Facebook_Secret_Key": r"([f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K]|[f|F][b|B])(.{0,20})?['\"][0-9a-f]{32}",
+	"Firebase": r"[a-z0-9.-]+\\.firebaseio\\.com",
+	"Generic_API_Key": r"[a|A][p|P][i|I][_]?[k|K][e|E][y|Y].*['|\"][0-9a-zA-Z]{32,45}['|\"]",
+	"Generic_Secret": r"[s|S][e|E][c|C][r|R][e|E][t|T].*['|\"][0-9a-zA-Z]{32,45}['|\"]",
+	"GitHub": r"[g|G][i|I][t|T][h|H][u|U][b|B].*['|\"][0-9a-zA-Z]{35,40}['|\"]",
+	"GitHub_Access_Token": r"([a-zA-Z0-9_-]*:[a-zA-Z0-9_-]+@github.com*)$",
+	"Google_API_Key": r"AIza[0-9A-Za-z\\-_]{35}",
+	"Google_Cloud_Platform_OAuth": r"[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com",
+	"Google_Cloud_Platform_Service_Account": r"\"type\": \"service_account\"",
+	"Google_OAuth_Access_Token": r"ya29\\.[0-9A-Za-z\\-_]+",
+	"HackerOne_CTF_Flag": r"[h|H]1(?:[c|C][t|T][f|F])?\\{.*\\}",
+	"HackTheBox_CTF_Flag": r"[h|H](?:[a|A][c|C][k|K][t|T][h|H][e|E][b|B][o|O][x|X]|[t|T][b|B])\\{.*\\}$",
+	"Heroku_API_Key": r"[h|H][e|E][r|R][o|O][k|K][u|U].*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}",
+	"IP_Address": r"(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])",
+	"JSON_Web_Token": r"(?i)^((?=.*[a-z])(?=.*[0-9])(?:[a-z0-9_=]+\\.){2}(?:[a-z0-9_\\-\\+\/=]*))$",
+	"LinkFinder": r"(?:\"|')(((?:[a-zA-Z]{1,10}:\/\/|\/\/)[^\"'\/]{1,}\\.[a-zA-Z]{2,}[^\"']{0,})|((?:\/|\\.\\.\/|\\.\/)[^\"'><,;| *()(%%$^\/\\\\\\[\\]][^\"'><,;|()]{1,})|([a-zA-Z0-9_\\-\/]{1,}\/[a-zA-Z0-9_\\-\/]{1,}\\.(?:[a-zA-Z]{1,4}|action)(?:[\\?|#][^\"|']{0,}|))|([a-zA-Z0-9_\\-\/]{1,}\/[a-zA-Z0-9_\\-\/]{3,}(?:[\\?|#][^\"|']{0,}|))|([a-zA-Z0-9_\\-]{1,}\\.(?:php|asp|aspx|jsp|json|action|html|js|txt|xml)(?:[\\?|#][^\"|']{0,}|)))(?:\"|')",
+	"Mac_Address": r"(([0-9A-Fa-f]{2}[:]){5}[0-9A-Fa-f]{2}|([0-9A-Fa-f]{2}[-]){5}[0-9A-Fa-f]{2}|([0-9A-Fa-f]{4}[\\.]){2}[0-9A-Fa-f]{4})$",
+	"MailChimp_API_Key": r"[0-9a-f]{32}-us[0-9]{1,2}",
+	"Mailgun_API_Key": r"key-[0-9a-zA-Z]{32}",
+	"Mailto": r"(?<=mailto:)[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\.[a-zA-Z0-9.-]+",
+	"Password_in_URL": r"[a-zA-Z]{3,10}://[^/\\s:@]{3,20}:[^/\\s:@]{3,20}@.{1,100}[\"'\\s]",
+	"PayPal_Braintree_Access_Token": r"access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}",
+	"PGP_private_key_block": r"-----BEGIN PGP PRIVATE KEY BLOCK-----",
+	"Picatic_API_Key": r"sk_live_[0-9a-z]{32}",
+	"RSA_Private_Key": r"-----BEGIN RSA PRIVATE KEY-----",
+	"Slack_Token": r"(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
+	"Slack_Webhook": r"https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
+	"Square_Access_Token": r"sq0atp-[0-9A-Za-z\\-_]{22}",
+	"Square_OAuth_Secret": r"sq0csp-[0-9A-Za-z\\-_]{43}",
+	"SSH_DSA_Private_Key": r"-----BEGIN DSA PRIVATE KEY-----",
+	"SSH_EC_Private_Key": r"-----BEGIN EC PRIVATE KEY-----",
+	"Stripe_API_Key": r"sk_live_[0-9a-zA-Z]{24}",
+	"Stripe_Restricted_API_Key": r"rk_live_[0-9a-zA-Z]{24}",
+	"TryHackMe_CTF_Flag": r"[t|T](?:[r|R][y|Y][h|H][a|A][c|C][k|K][m|M][e|E]|[h|H][m|M])\\{.*\\}$",
+	"Twilio_API_Key": r"SK[0-9a-fA-F]{32}",
+	"Twitter_Access_Token": r"[t|T][w|W][i|I][t|T][t|T][e|E][r|R].*[1-9][0-9]+-[0-9a-zA-Z]{40}",
+	"Twitter_ClientID": r"[t|T][w|W][i|I][t|T][t|T][e|E][r|R](.{0,20})?['\"][0-9a-z]{18,25}",
+	"Twitter_OAuth": r"[t|T][w|W][i|I][t|T][t|T][e|E][r|R].*['|\"][0-9a-zA-Z]{35,44}['|\"]",
+	"Twitter_Secret_Key": r"[t|T][w|W][i|I][t|T][t|T][e|E][r|R](.{0,20})?['\"][0-9a-z]{35,44}"
+}
+
 # 此处配置壳信息
 shell_list =[
     'com.stub.StubApp',

libs/core/parses.py

@@ -56,15 +56,24 @@ class ParsesThreads(threading.Thread):
 
             # 搜素AK和SK信息
             if not ".js" == file_path[-3:]:
-                akAndSkList = re.compile(r'.*accessKeyId.*".*"|.*accessKeySecret.*".*"|.*secret.*".*"').findall(file_content)
+                for key,values in config.filter_ak_map.items():
-                for akAndSk in akAndSkList:
+                    if isinstance(values,list):
-                    self.result_list.append(akAndSk.strip())
+                        for value in values:
-                    print("[+] AK or SK in:",akAndSk.strip())
+                            self.__ak_and_sk__(key, value, file_content)
+                    else:
+                       self.__ak_and_sk__(key, values, file_content)
 
             # 遍历所有的字符串
             for result in set(results): 
                 self.__parse_string__(result)    
     
+    def __ak_and_sk__(self, name, ak_rule,content):
+        akAndSkList = re.compile(ak_rule).findall(content)
+        for akAndSk in akAndSkList:
+            ak = ("[%s]-->:%s") % (name,akAndSk.strip())
+            self.result_list.append(ak)
+            print("[+] [%s] AK or SK in %s:") % (name, akAndSk.strip())
+
     def __parse_string__(self,result):
         # 通过正则筛选需要过滤的字符串
         for filter_str in config.filter_strs:

libs/task/ios_task.py

@@ -117,7 +117,11 @@ class iOSTask(object):
                         os.makedirs(dir_path)
                 shutil.move(old_ext_path, new_ext_path)
                 if os.path.exists(old_ext_path):
+                    try:
+                        # mac发生权限问题的时候做处理
                         os.remove(old_ext_path)
+                    except Exception:
+                        shutil.rmtree(old_ext_path)
 
 
     def __get_parse_dir__(self,output_path,file_path):

libs/task/web_task.py

@@ -4,6 +4,7 @@
 # Github: https://github.com/kelvinBen/AppInfoScanner
 import os
 import config
+import hashlib
 from queue import Queue
 
 class WebTask(object):
@@ -39,7 +40,7 @@ class WebTask(object):
             else:
                 if len(dir_file.split("."))>1:
                     if dir_file.split(".")[-1] in file_suffix:
-                        with open(file_path,'rb') as f:
+                        with open(dir_file_path,'rb') as f:
                             dex_md5 = str(hashlib.md5().update(f.read()).hexdigest()).upper()
                             self.file_identifier.append(dex_md5)
                         self.file_queue.put(dir_file_path)