diff --git a/fixtures/file b/fixtures/file index e129c5b..8a2c776 100644 --- a/fixtures/file +++ b/fixtures/file @@ -1,42 +1,46 @@ -#! python3 -0x52908400098527886E0F7030069857D2E4169EE7 -DANHz6EQVoWyZ9rER56DwTXHWUxfkv9k2o -print("hello) - -thm{"Can you guess what this is, now?"} -THM{this is a flag} -0x52908400098527886E0F7030069857D2E4169EE730000000000004 -0x52908400098527886E0F7030069857D2E4169EE7 -@pytest.mark.skip(reason="Fails Regex due to http://") -"1KFHE7w8BhaENAswwryaoccDb6qcT6DbYY" -16ftSEQ4ctQFDtVZiUBusQUjRrGhM3JYwe -4462030000000000 -thm{"uh hello?"} -001-01-0001 -flag{"helo jenny dwi'n gwybod eich bod chi'n darllen hwn diolch am fod yn ffrind i mi "} -340000000000009 -30569309025904 -http://10.1.1.1 -https://www.youtube.com/watch?v=ScOAntcCa78 -adsadasdasdhttps://www.youtube.com/watch?v=trj15fjXWDwasdasdasd -6011000000000004 -htb{4111111111111111} -3000 0000 0000 04 -5500000000000004 - -james:S3cr37_P@$$W0rd -ScOAntcCa78 -

hello

-127.0.0.1 -github@skerritt.blog - -Access-Control-Allow-Headers: * - -47DF8D9NwtmefhFUghynYRMqrexiZTsm48T1hhi2jZcbfcwoPbkhMrrED6zqJRfeYpXFfdaqAT3jnBEwoMwCx6BYDJ1W3ub -LRX8rSPVjifTxoLeoJtLf2JYdJFTQFcE7m -bitcoincash:qzlg6uvceehgzgtz6phmvy8gtdqyt6vf359at4n3lq -rBPAQmwMrt7FDDPNyjwFgwSqbWZPf6SLkk -2001:0db8:85a3:0000:0000:8a2e:0370:7334 - -eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c -+91 (385) 985 2821 \ No newline at end of file +#! python3 +0x52908400098527886E0F7030069857D2E4169EE7 +DANHz6EQVoWyZ9rER56DwTXHWUxfkv9k2o +print("hello) + +thm{"Can you guess what this is, now?"} +THM{this is a flag} +0x52908400098527886E0F7030069857D2E4169EE730000000000004 +0x52908400098527886E0F7030069857D2E4169EE7 +@pytest.mark.skip(reason="Fails Regex due to http://") +"1KFHE7w8BhaENAswwryaoccDb6qcT6DbYY" +16ftSEQ4ctQFDtVZiUBusQUjRrGhM3JYwe +4462030000000000 +thm{"uh hello?"} +001-01-0001 +flag{"helo jenny dwi'n gwybod eich bod chi'n darllen hwn diolch am fod yn ffrind i mi "} +340000000000009 +30569309025904 +http://10.1.1.1 +https://www.youtube.com/watch?v=ScOAntcCa78 +adsadasdasdhttps://www.youtube.com/watch?v=trj15fjXWDwasdasdasd +6011000000000004 +htb{4111111111111111} +3000 0000 0000 04 +5500000000000004 + +james:S3cr37_P@$$W0rd +ScOAntcCa78 +

hello

+127.0.0.1 +github@skerritt.blog + +Access-Control-Allow-Headers: * + +47DF8D9NwtmefhFUghynYRMqrexiZTsm48T1hhi2jZcbfcwoPbkhMrrED6zqJRfeYpXFfdaqAT3jnBEwoMwCx6BYDJ1W3ub +LRX8rSPVjifTxoLeoJtLf2JYdJFTQFcE7m +bitcoincash:qzlg6uvceehgzgtz6phmvy8gtdqyt6vf359at4n3lq +rBPAQmwMrt7FDDPNyjwFgwSqbWZPf6SLkk +2001:0db8:85a3:0000:0000:8a2e:0370:7334 + +eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c ++91 (385) 985 2821 + +ssh-rsa AAAAB3NzaC1tc2EAAAADAQABAAACAQDrnjkGtf3iA46rtwsvRiscvMTCw30l5Mmln/sf8Wohg4RPc7nuIx3/fB86K9jzBNoQk6Fb00p2cSW0dX6c3OTL5R5Q0rBjOFy6GV07MkS7rXa7WYh4ObxBh+M+LEzxVIw29anzQFZkR0TAf6x2rBoErK7JYU4fyqFBDFupTt3coQDPEEmVwtLLUCEnJrurbbnJKcWJ+/FbItLxYyMLPl8TwEn0iqiJ97onCU2DuBtiYv3hp1WoEH08b5WDF0F04zEPRdJT+WisxlEFRgaj51o2BtjOC+D2qZQDb4LHaAfJ0WcO4nu7YocdlcLp2JPfXKKgu9P5J8UDsmXbR3KCJ1oddFa2R6TbHc6d2hKyG4amBzMX5ltxXu7D6FLPZlFqua8YooY7A2zwIVirOUH/cfx+5O9o0CtspkNmj/iYzN0FPaOpELncWsuauy9hrGql/1cF4SUr20zHFoBoDQUtmvmBnWnKoGfpWXzuda449FVtmcrEjvBzCvCb3RStu0BbyOOybJagbKif3MkcYVO10pRbTveIUwgCD6F3ypD11XztoPNsgScmjme0sj/KWWNLyQkLWtpJEQ4k46745NAC5g+nP28TR2JM8doeqsxA8JovQkLWwDcR+WYZu2z/I8dfhOmalnoMRTJ2NzWDc0OSkKGYWjexR4fN6lAKCUOUptl9Nw== r00t@my-random_host +ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCE9Uli8bGnD4hOWdeo5KKQJ/P/vOazI4MgqJK54w37emP2JwOAOdMmXuwpxbKng3KZz27mz+nKWIlXJ3rzSGMo= r00t@my-random_host +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0wmN/Cr3JXqmLW7u+g9pTh+wyqDHpSQEIQczXkVx9q r00t@my-random_host diff --git a/pywhat/Data/regex.json b/pywhat/Data/regex.json index ae7ea68..cbf6447 100644 --- a/pywhat/Data/regex.json +++ b/pywhat/Data/regex.json @@ -1,4 +1,40 @@ [ + { + "Name": "SSH RSA Public Key", + "Regex": "ssh-rsa [A-Za-z0-9+\/=]+ [^ \n]+", + "plural_name": false, + "Description": null, + "Rarity": 1, + "URL": null, + "Tags": [ + "Credentials", + "Cyber Security" + ] + }, + { + "Name": "SSH ECDSA Public Key", + "Regex": "ecdsa-sha2-nistp[0-9]{3} [A-Za-z0-9+\/=]+ [^ \n]+", + "plural_name": false, + "Description": null, + "Rarity": 1, + "URL": null, + "Tags": [ + "Credentials", + "Cyber Security" + ] + }, + { + "Name": "SSH ED25519 Public Key", + "Regex": "ssh-ed25519 [A-Za-z0-9+\/=]+ [^ \n]+", + "plural_name": false, + "Description": null, + "Rarity": 1, + "URL": null, + "Tags": [ + "Credentials", + "Cyber Security" + ] + }, { "Name": "Ethereum (ETH) Wallet Address", "Regex": "(?i)^0x[a-f0-9]{40}$", diff --git a/tests/test_click.py b/tests/test_click.py index 6da4bbd..40efeb3 100644 --- a/tests/test_click.py +++ b/tests/test_click.py @@ -454,3 +454,21 @@ def test_only_text(): result = runner.invoke(main, ["-o", "fixtures/file"]) assert result.exit_code == 0 assert "Nothing found" in result.output + +def test_ssh_rsa_key(): + runner = CliRunner() + result = runner.invoke(main, ["fixtures/file"]) + assert result.exit_code == 0 + assert re.findall("SSH RSA", str(result.output)) + +def test_ssh_ecdsa_key(): + runner = CliRunner() + result = runner.invoke(main, ["fixtures/file"]) + assert result.exit_code == 0 + assert re.findall("SSH ECDSA", str(result.output)) + +def test_ssh_ed25519_key(): + runner = CliRunner() + result = runner.invoke(main, ["fixtures/file"]) + assert result.exit_code == 0 + assert re.findall("SSH ED25519", str(result.output)) diff --git a/tests/test_regex_identifier.py b/tests/test_regex_identifier.py index dd03f4b..d556142 100644 --- a/tests/test_regex_identifier.py +++ b/tests/test_regex_identifier.py @@ -389,3 +389,30 @@ def test_arn4(): r = regex_identifier.RegexIdentifier() res = r.check(["arn:aws:s3:::my_corporate_bucket/Development/*"]) assert "ARN" in str(res) + +def test_ssh_rsa_key(): + r = regex_identifier.RegexIdentifier() + res = r.check( + [ + "ssh-rsa AAAAB3NzaC1tc2EAAAADAQABAAACAQDrnjkGtf3iA46rtwsvRiscvMTCw30l5Mmln/sf8Wohg4RPc7nuIx3/fB86K9jzBNoQk6Fb00p2cSW0dX6c3OTL5R5Q0rBjOFy6GV07MkS7rXa7WYh4ObxBh+M+LEzxVIw29anzQFZkR0TAf6x2rBoErK7JYU4fyqFBDFupTt3coQDPEEmVwtLLUCEnJrurbbnJKcWJ+/FbItLxYyMLPl8TwEn0iqiJ97onCU2DuBtiYv3hp1WoEH08b5WDF0F04zEPRdJT+WisxlEFRgaj51o2BtjOC+D2qZQDb4LHaAfJ0WcO4nu7YocdlcLp2JPfXKKgu9P5J8UDsmXbR3KCJ1oddFa2R6TbHc6d2hKyG4amBzMX5ltxXu7D6FLPZlFqua8YooY7A2zwIVirOUH/cfx+5O9o0CtspkNmj/iYzN0FPaOpELncWsuauy9hrGql/1cF4SUr20zHFoBoDQUtmvmBnWnKoGfpWXzuda449FVtmcrEjvBzCvCb3RStu0BbyOOybJagbKif3MkcYVO10pRbTveIUwgCD6F3ypD11XztoPNsgScmjme0sj/KWWNLyQkLWtpJEQ4k46745NAC5g+nP28TR2JM8doeqsxA8JovQkLWwDcR+WYZu2z/I8dfhOmalnoMRTJ2NzWDc0OSkKGYWjexR4fN6lAKCUOUptl9Nw== r00t@my-random_host" + ] + ) + assert "SSH RSA" in str(res) + +def test_ssh_ecdsa_key(): + r = regex_identifier.RegexIdentifier() + res = r.check( + [ + "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCE9Uli8bGnD4hOWdeo5KKQJ/P/vOazI4MgqJK54w37emP2JwOAOdMmXuwpxbKng3KZz27mz+nKWIlXJ3rzSGMo= r00t@my-random_host" + ] + ) + assert "SSH ECDSA" in str(res) + +def test_ssh_ed25519_key(): + r = regex_identifier.RegexIdentifier() + res = r.check( + [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0wmN/Cr3JXqmLW7u+g9pTh+wyqDHpSQEIQczXkVx9q r00t@my-random_host" + ] + ) + assert "SSH ED25519" in str(res)