283 Posted June 20 Posted June 20 Ich arbeite derzeit an einem Bot, der neue GitHub-Repositories überwacht und nach potenziell sensiblen oder vertraulichen Informationen sucht. Die Ergebnisse werden automatisch erfasst. Hier sind einige Beispiele für die bisherigen Funde. https://paste.me/paste/c71b995a-cf13-46dc-6378-b4d438b17c25#896b207605966fd1822510b0f64dce9201a0fb65f185714a939d2c09fa338baf Bisher scannt der nach folgenden Sachen : PATTERNS = [ # ── Mail Server ───────────────────────────────────────────────────────── {'name':'SMTP URL', 'type':'smtp_url', 'category':'Mail Server', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'smtps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'smtp[s]://user:pass@host[:port]', 'prefix_len':7}, {'name':'IMAP URL', 'type':'imap_url', 'category':'Mail Server', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'imaps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'imap[s]://user:pass@host[:port]', 'prefix_len':7}, # ── File Transfer ──────────────────────────────────────────────────────── {'name':'FTP URL', 'type':'ftp_url', 'category':'FTP/SFTP', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'ftps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?(?:/[^\s"\'<>]*)?', 'format_hint':'ftp[s]://user:pass@host[:port]', 'prefix_len':6}, {'name':'SFTP URL', 'type':'sftp_url', 'category':'FTP/SFTP', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sftp://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'sftp://user:pass@host[:port]', 'prefix_len':7}, # ── Remote Access ──────────────────────────────────────────────────────── {'name':'RDP URL', 'type':'rdp_url', 'category':'Remote Access', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'rdp://[a-zA-Z0-9._%+\\\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'rdp://user:pass@host[:3389]', 'prefix_len':6}, {'name':'VNC URL', 'type':'vnc_url', 'category':'Remote Access', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'vnc://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'vnc://user:pass@host[:5900]', 'prefix_len':6}, # ── VPN ────────────────────────────────────────────────────────────────── {'name':'WireGuard Private Key', 'type':'wireguard_key', 'category':'VPN', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?m)^PrivateKey\s*=\s*([A-Za-z0-9+/]{43}=)', 'format_hint':'PrivateKey = [44 base64 chars]', 'prefix_len':0}, {'name':'OpenVPN Static Key', 'type':'openvpn_key', 'category':'VPN', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN OpenVPN Static key V1-----', 'format_hint':'-----BEGIN OpenVPN Static key V1-----', 'prefix_len':37}, # ── Private Keys / SSH ─────────────────────────────────────────────────── {'name':'RSA Private Key', 'type':'rsa_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN RSA PRIVATE KEY-----', 'format_hint':'-----BEGIN RSA PRIVATE KEY----- (PEM)', 'prefix_len':31}, {'name':'OpenSSH Private Key', 'type':'openssh_private_key','category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN OPENSSH PRIVATE KEY-----', 'format_hint':'-----BEGIN OPENSSH PRIVATE KEY----- (PEM)', 'prefix_len':35}, {'name':'EC Private Key', 'type':'ec_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN EC PRIVATE KEY-----', 'format_hint':'-----BEGIN EC PRIVATE KEY----- (PEM)', 'prefix_len':29}, {'name':'PGP Private Key', 'type':'pgp_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN PGP PRIVATE KEY BLOCK-----', 'format_hint':'-----BEGIN PGP PRIVATE KEY BLOCK-----', 'prefix_len':37}, {'name':'Generic Private Key', 'type':'private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN PRIVATE KEY-----', 'format_hint':'-----BEGIN PRIVATE KEY----- (PKCS#8)', 'prefix_len':26}, # ── Database ───────────────────────────────────────────────────────────── {'name':'Database Connection URL', 'type':'database_url', 'category':'Database', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?i)(mongodb(?:\+srv)?|postgres(?:ql)?|mysql|mariadb|redis(?:is)?|amqp|mssql|cockroachdb|cassandra|couchdb)://[a-zA-Z0-9._\-]+:[^@\s"\'<>{}\[\]]{4,}@[a-zA-Z0-9._\-]+', 'format_hint':'protocol://user:pass@host/db', 'prefix_len':12}, # ── Cloud ──────────────────────────────────────────────────────────────── {'name':'AWS Access Key ID', 'type':'aws_access_key', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'AKIA[0-9A-Z]{16}', 'format_hint':'AKIA[16 uppercase alphanumeric]', 'prefix_len':4}, {'name':'AWS Secret Access Key', 'type':'aws_secret_key', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?i)aws[_\-\s\.]{0,5}secret[_\-\s\.]{0,10}["\']?\b([A-Za-z0-9/+=]{40})\b', 'format_hint':'aws_secret = [40 base64]', 'prefix_len':0}, {'name':'Azure Storage Connection', 'type':'azure_storage', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[A-Za-z0-9+/=]{85,}', 'format_hint':'AccountKey=[88 base64]', 'prefix_len':32}, {'name':'DigitalOcean Token', 'type':'do_token', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'dop_v1_[a-fA-F0-9]{64}', 'format_hint':'dop_v1_[64 hex]', 'prefix_len':7}, {'name':'Google Service Account', 'type':'google_service_acct','category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'"type"\s*:\s*"service_account"', 'format_hint':'{"type":"service_account",...}', 'prefix_len':27}, # ── Payment ────────────────────────────────────────────────────────────── {'name':'Stripe Live Secret Key', 'type':'stripe_secret', 'category':'Payment', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk_live_[0-9a-zA-Z]{24,}', 'format_hint':'sk_live_[24+ alphanumeric]', 'prefix_len':8}, {'name':'PayPal Client Secret', 'type':'paypal_secret', 'category':'Payment', 'severity':'CRITICAL','confidence':'MEDIUM', 'pattern':r'(?i)paypal[^"\']{0,30}(?:secret|client_secret)[^"\']{0,10}["\']([A-Za-z0-9\-_]{20,})["\']', 'format_hint':'paypal client_secret = "[20+]"', 'prefix_len':0}, # ── AI / LLM ───────────────────────────────────────────────────────────── {'name':'OpenAI API Key', 'type':'openai_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-[a-zA-Z0-9]{48}', 'format_hint':'sk-[48 alphanumeric]', 'prefix_len':7}, {'name':'OpenAI Project Key', 'type':'openai_project_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-proj-[a-zA-Z0-9\-_]{20,}', 'format_hint':'sk-proj-[20+ chars]', 'prefix_len':10}, {'name':'Anthropic API Key', 'type':'anthropic_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-ant-[a-zA-Z0-9\-_]{20,}', 'format_hint':'sk-ant-[20+ chars]', 'prefix_len':10}, # ── Auth Tokens ────────────────────────────────────────────────────────── {'name':'GitHub PAT (classic)', 'type':'github_pat', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'ghp_[A-Za-z0-9]{36}', 'format_hint':'ghp_[36 alphanumeric]', 'prefix_len':4}, {'name':'GitHub Fine-grained PAT', 'type':'github_fine_pat', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'github_pat_[A-Za-z0-9_]{82}', 'format_hint':'github_pat_[82 chars]', 'prefix_len':11}, {'name':'Slack Bot Token', 'type':'slack_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'xoxb-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}', 'format_hint':'xoxb-[team]-[bot]-[24]', 'prefix_len':5}, {'name':'Discord Bot Token', 'type':'discord_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'[MN][a-zA-Z0-9_\-]{23,25}\.[a-zA-Z0-9_\-]{6}\.[a-zA-Z0-9_\-]{27}', 'format_hint':'[M/N][23-25].[6].[27]', 'prefix_len':6}, {'name':'Telegram Bot Token', 'type':'telegram_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\b[0-9]{9,10}:AA[a-zA-Z0-9_\-]{33}\b', 'format_hint':'[bot_id]:AA[33]', 'prefix_len':10}, {'name':'SendGrid API Key', 'type':'sendgrid_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'SG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43}', 'format_hint':'SG.[22].[43]', 'prefix_len':3}, {'name':'Google API Key', 'type':'google_api_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'AIza[0-9A-Za-z\-_]{35}', 'format_hint':'AIza[35 alphanumeric]', 'prefix_len':4}, {'name':'Mailgun API Key', 'type':'mailgun_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bkey-[0-9a-zA-Z]{32}\b', 'format_hint':'key-[32 alphanumeric]', 'prefix_len':4}, {'name':'NPM Access Token', 'type':'npm_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'npm_[A-Za-z0-9]{36}', 'format_hint':'npm_[36 alphanumeric]', 'prefix_len':4}, # ── Additional AI providers ────────────────────────────────────────────── {'name':'Groq API Key', 'type':'groq_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'gsk_[A-Za-z0-9]{52}', 'format_hint':'gsk_[52 chars]', 'prefix_len':4}, {'name':'Replicate API Key', 'type':'replicate_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'r8_[A-Za-z0-9]{40}', 'format_hint':'r8_[40 chars]', 'prefix_len':3}, {'name':'Mistral API Key', 'type':'mistral_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'MISTRAL_API_KEY\s*[=:]\s*["\']?([A-Za-z0-9_\-]{32,64})["\']?', 'format_hint':'MISTRAL_API_KEY=[32-64 chars]', 'prefix_len':0}, {'name':'Cohere API Key', 'type':'cohere_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'COHERE_API_KEY\s*[=:]\s*["\']?([A-Za-z0-9_\-]{32,64})["\']?', 'format_hint':'COHERE_API_KEY=[32-64 chars]', 'prefix_len':0}, {'name':'Together AI Key', 'type':'together_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'TOGETHER(?:AI)?_API_KEY\s*[=:]\s*["\']?([a-f0-9]{64})["\']?', 'format_hint':'TOGETHER_API_KEY=[64 hex chars]', 'prefix_len':0}, # ── Stripe test key (lower severity — no real money) ───────────────────── {'name':'Stripe Test Key', 'type':'stripe_test', 'category':'Payment Keys', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'sk_test_[A-Za-z0-9]{24,}', 'format_hint':'sk_test_[24+ chars]', 'prefix_len':8}, ] Falls ihr noch Ideen habt, was man zusätzlich einbauen könnte, immer her damit :) 0 Quote
283 Posted June 20 Author Posted June 20 Erweitert : PATTERNS = [ # ── Mail Server ───────────────────────────────────────────────────────── {'name':'SMTP URL', 'type':'smtp_url', 'category':'Mail Server', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'smtps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'smtp[s]://user:pass@host[:port]', 'prefix_len':7}, {'name':'IMAP URL', 'type':'imap_url', 'category':'Mail Server', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'imaps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'imap[s]://user:pass@host[:port]', 'prefix_len':7}, # ── File Transfer ──────────────────────────────────────────────────────── {'name':'FTP URL', 'type':'ftp_url', 'category':'FTP/SFTP', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'ftps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?(?:/[^\s"\'<>]*)?', 'format_hint':'ftp[s]://user:pass@host[:port]', 'prefix_len':6}, {'name':'SFTP URL', 'type':'sftp_url', 'category':'FTP/SFTP', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sftp://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'sftp://user:pass@host[:port]', 'prefix_len':7}, # ── Remote Access ──────────────────────────────────────────────────────── {'name':'RDP URL', 'type':'rdp_url', 'category':'Remote Access', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'rdp://[a-zA-Z0-9._%+\\\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'rdp://user:pass@host[:3389]', 'prefix_len':6}, {'name':'VNC URL', 'type':'vnc_url', 'category':'Remote Access', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'vnc://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'vnc://user:pass@host[:5900]', 'prefix_len':6}, # ── VPN ────────────────────────────────────────────────────────────────── {'name':'WireGuard Private Key', 'type':'wireguard_key', 'category':'VPN', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?m)^PrivateKey\s*=\s*([A-Za-z0-9+/]{43}=)', 'format_hint':'PrivateKey = [44 base64 chars]', 'prefix_len':0}, {'name':'OpenVPN Static Key', 'type':'openvpn_key', 'category':'VPN', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN OpenVPN Static key V1-----', 'format_hint':'-----BEGIN OpenVPN Static key V1-----', 'prefix_len':37}, # ── Private Keys / SSH ─────────────────────────────────────────────────── {'name':'RSA Private Key', 'type':'rsa_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN RSA PRIVATE KEY-----', 'format_hint':'-----BEGIN RSA PRIVATE KEY----- (PEM)', 'prefix_len':31}, {'name':'OpenSSH Private Key', 'type':'openssh_private_key','category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN OPENSSH PRIVATE KEY-----', 'format_hint':'-----BEGIN OPENSSH PRIVATE KEY----- (PEM)', 'prefix_len':35}, {'name':'EC Private Key', 'type':'ec_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN EC PRIVATE KEY-----', 'format_hint':'-----BEGIN EC PRIVATE KEY----- (PEM)', 'prefix_len':29}, {'name':'PGP Private Key', 'type':'pgp_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN PGP PRIVATE KEY BLOCK-----', 'format_hint':'-----BEGIN PGP PRIVATE KEY BLOCK-----', 'prefix_len':37}, {'name':'Generic Private Key', 'type':'private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN PRIVATE KEY-----', 'format_hint':'-----BEGIN PRIVATE KEY----- (PKCS#8)', 'prefix_len':26}, # ── Database ───────────────────────────────────────────────────────────── {'name':'Database Connection URL', 'type':'database_url', 'category':'Database', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?i)(mongodb(?:\+srv)?|postgres(?:ql)?|mysql|mariadb|redis(?:is)?|amqp|mssql|cockroachdb|cassandra|couchdb)://[a-zA-Z0-9._\-]+:[^@\s"\'<>{}\[\]]{4,}@[a-zA-Z0-9._\-]+', 'format_hint':'protocol://user:pass@host/db', 'prefix_len':12}, # ── Cloud ──────────────────────────────────────────────────────────────── {'name':'AWS Access Key ID', 'type':'aws_access_key', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'AKIA[0-9A-Z]{16}', 'format_hint':'AKIA[16 uppercase alphanumeric]', 'prefix_len':4}, {'name':'AWS Secret Access Key', 'type':'aws_secret_key', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?i)aws[_\-\s\.]{0,5}secret[_\-\s\.]{0,10}["\']?\b([A-Za-z0-9/+=]{40})\b', 'format_hint':'aws_secret = [40 base64]', 'prefix_len':0}, {'name':'Azure Storage Connection', 'type':'azure_storage', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[A-Za-z0-9+/=]{85,}', 'format_hint':'AccountKey=[88 base64]', 'prefix_len':32}, {'name':'DigitalOcean Token', 'type':'do_token', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'dop_v1_[a-fA-F0-9]{64}', 'format_hint':'dop_v1_[64 hex]', 'prefix_len':7}, {'name':'Google Service Account', 'type':'google_service_acct','category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'"type"\s*:\s*"service_account"', 'format_hint':'{"type":"service_account",...}', 'prefix_len':27}, # ── Payment ────────────────────────────────────────────────────────────── {'name':'Stripe Live Secret Key', 'type':'stripe_secret', 'category':'Payment', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk_live_[0-9a-zA-Z]{24,}', 'format_hint':'sk_live_[24+ alphanumeric]', 'prefix_len':8}, {'name':'PayPal Client Secret', 'type':'paypal_secret', 'category':'Payment', 'severity':'CRITICAL','confidence':'MEDIUM', 'pattern':r'(?i)paypal[^"\']{0,30}(?:secret|client_secret)[^"\']{0,10}["\']([A-Za-z0-9\-_]{20,})["\']', 'format_hint':'paypal client_secret = "[20+]"', 'prefix_len':0}, # ── AI / LLM ───────────────────────────────────────────────────────────── {'name':'OpenAI API Key', 'type':'openai_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-[a-zA-Z0-9]{48}', 'format_hint':'sk-[48 alphanumeric]', 'prefix_len':7}, {'name':'OpenAI Project Key', 'type':'openai_project_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-proj-[a-zA-Z0-9\-_]{20,}', 'format_hint':'sk-proj-[20+ chars]', 'prefix_len':10}, {'name':'Anthropic API Key', 'type':'anthropic_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-ant-[a-zA-Z0-9\-_]{20,}', 'format_hint':'sk-ant-[20+ chars]', 'prefix_len':10}, # ── Auth Tokens ────────────────────────────────────────────────────────── {'name':'GitHub PAT (classic)', 'type':'github_pat', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'ghp_[A-Za-z0-9]{36}', 'format_hint':'ghp_[36 alphanumeric]', 'prefix_len':4}, {'name':'GitHub Fine-grained PAT', 'type':'github_fine_pat', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'github_pat_[A-Za-z0-9_]{82}', 'format_hint':'github_pat_[82 chars]', 'prefix_len':11}, {'name':'Slack Bot Token', 'type':'slack_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'xoxb-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}', 'format_hint':'xoxb-[team]-[bot]-[24]', 'prefix_len':5}, {'name':'Discord Bot Token', 'type':'discord_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'[MN][a-zA-Z0-9_\-]{23,25}\.[a-zA-Z0-9_\-]{6}\.[a-zA-Z0-9_\-]{27}', 'format_hint':'[M/N][23-25].[6].[27]', 'prefix_len':6}, {'name':'Telegram Bot Token', 'type':'telegram_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\b[0-9]{9,10}:AA[a-zA-Z0-9_\-]{33}\b', 'format_hint':'[bot_id]:AA[33]', 'prefix_len':10}, {'name':'SendGrid API Key', 'type':'sendgrid_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'SG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43}', 'format_hint':'SG.[22].[43]', 'prefix_len':3}, {'name':'Google API Key', 'type':'google_api_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'AIza[0-9A-Za-z\-_]{35}', 'format_hint':'AIza[35 alphanumeric]', 'prefix_len':4}, {'name':'Mailgun API Key', 'type':'mailgun_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bkey-[0-9a-zA-Z]{32}\b', 'format_hint':'key-[32 alphanumeric]', 'prefix_len':4}, {'name':'NPM Access Token', 'type':'npm_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'npm_[A-Za-z0-9]{36}', 'format_hint':'npm_[36 alphanumeric]', 'prefix_len':4}, # ── Additional AI providers ────────────────────────────────────────────── {'name':'Groq API Key', 'type':'groq_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'gsk_[A-Za-z0-9]{52}', 'format_hint':'gsk_[52 chars]', 'prefix_len':4}, {'name':'Replicate API Key', 'type':'replicate_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'r8_[A-Za-z0-9]{40}', 'format_hint':'r8_[40 chars]', 'prefix_len':3}, {'name':'Mistral API Key', 'type':'mistral_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'MISTRAL_API_KEY\s*[=:]\s*["\']?([A-Za-z0-9_\-]{32,64})["\']?', 'format_hint':'MISTRAL_API_KEY=[32-64 chars]', 'prefix_len':0}, {'name':'Cohere API Key', 'type':'cohere_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'COHERE_API_KEY\s*[=:]\s*["\']?([A-Za-z0-9_\-]{32,64})["\']?', 'format_hint':'COHERE_API_KEY=[32-64 chars]', 'prefix_len':0}, {'name':'Together AI Key', 'type':'together_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'TOGETHER(?:AI)?_API_KEY\s*[=:]\s*["\']?([a-f0-9]{64})["\']?', 'format_hint':'TOGETHER_API_KEY=[64 hex chars]', 'prefix_len':0}, # ── Stripe test key (lower severity — no real money) ───────────────────── {'name':'Stripe Test Key', 'type':'stripe_test', 'category':'Payment Keys', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'sk_test_[A-Za-z0-9]{24,}', 'format_hint':'sk_test_[24+ chars]', 'prefix_len':8}, # ── Version Control ────────────────────────────────────────────────────── {'name':'GitLab PAT', 'type':'gitlab_pat', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'glpat-[A-Za-z0-9\-_]{20}', 'format_hint':'glpat-[20 chars]', 'prefix_len':6}, {'name':'GitLab CI Token', 'type':'gitlab_ci_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'glcbt-[A-Za-z0-9\-_]{20}', 'format_hint':'glcbt-[20 chars]', 'prefix_len':6}, # ── Cloud / Infrastructure ─────────────────────────────────────────────── {'name':'Heroku API Key', 'type':'heroku_key', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'(?i)HEROKU_API_KEY\s*[=:]\s*["\']?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})["\']?', 'format_hint':'HEROKU_API_KEY=[UUID]', 'prefix_len':0}, {'name':'Fly.io Token', 'type':'flyio_token', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'fo1_[A-Za-z0-9\-_]{40,}', 'format_hint':'fo1_[40+ chars]', 'prefix_len':4}, {'name':'Cloudflare API Token', 'type':'cloudflare_token', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'(?i)CLOUDFLARE_(?:API_)?TOKEN\s*[=:]\s*["\']?([A-Za-z0-9_\-]{40})["\']?', 'format_hint':'CLOUDFLARE_TOKEN=[40 chars]', 'prefix_len':0}, {'name':'Azure AD Client Secret', 'type':'azure_client_secret','category':'Cloud', 'severity':'CRITICAL','confidence':'MEDIUM', 'pattern':r'(?i)AZURE_CLIENT_SECRET\s*[=:]\s*["\']?([A-Za-z0-9~._\-]{30,})["\']?', 'format_hint':'AZURE_CLIENT_SECRET=[30+ chars]', 'prefix_len':0}, # ── Developer Tools ────────────────────────────────────────────────────── {'name':'Hugging Face Token', 'type':'huggingface_token', 'category':'AI API Keys', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'hf_[a-zA-Z0-9]{34}', 'format_hint':'hf_[34 chars]', 'prefix_len':3}, {'name':'Databricks PAT', 'type':'databricks_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'dapi[a-f0-9]{32}', 'format_hint':'dapi[32 hex]', 'prefix_len':4}, {'name':'PyPI API Token', 'type':'pypi_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'pypi-[A-Za-z0-9\-_]{32,}', 'format_hint':'pypi-[32+ chars]', 'prefix_len':5}, {'name':'HashiCorp Vault Token', 'type':'vault_token', 'category':'Auth Tokens', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'hvs\.[A-Za-z0-9]{90,}', 'format_hint':'hvs.[90+ chars]', 'prefix_len':4}, # ── Webhooks ───────────────────────────────────────────────────────────── {'name':'Slack Incoming Webhook', 'type':'slack_webhook', 'category':'Webhooks', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'https://hooks\.slack\.com/services/T[A-Z0-9]{6,11}/B[A-Z0-9]{8,11}/[A-Za-z0-9]{24}', 'format_hint':'hooks.slack.com/services/T.../B.../[24]', 'prefix_len':29}, {'name':'Discord Webhook URL', 'type':'discord_webhook', 'category':'Webhooks', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'https://discord(?:app)?\.com/api/webhooks/[0-9]{17,20}/[A-Za-z0-9_\-]{60,80}', 'format_hint':'discord.com/api/webhooks/[id]/[token]', 'prefix_len':33}, {'name':'Twilio Account SID', 'type':'twilio_sid', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bAC[a-f0-9]{32}\b', 'format_hint':'AC[32 hex]', 'prefix_len':2}, {'name':'Twilio Auth Token', 'type':'twilio_auth', 'category':'Auth Tokens', 'severity':'CRITICAL','confidence':'MEDIUM', 'pattern':r'(?i)TWILIO_AUTH_TOKEN\s*[=:]\s*["\']?([a-f0-9]{32})["\']?', 'format_hint':'TWILIO_AUTH_TOKEN=[32 hex]', 'prefix_len':0}, # ── SaaS / Analytics / Identity ────────────────────────────────────────── {'name':'New Relic License Key', 'type':'newrelic_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'NRAK-[A-Z0-9]{27}', 'format_hint':'NRAK-[27 uppercase]', 'prefix_len':5}, {'name':'Sentry DSN', 'type':'sentry_dsn', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'https://[a-f0-9]{32}@(?:o[0-9]+\.)?(?:ingest\.)?sentry\.io/[0-9]+', 'format_hint':'https://[32hex]@...sentry.io/[id]', 'prefix_len':8}, {'name':'Okta API Token', 'type':'okta_token', 'category':'Auth Tokens', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'SSWS[A-Za-z0-9_\-]{40,}', 'format_hint':'SSWS[40+ chars]', 'prefix_len':4}, {'name':'Notion Integration Token', 'type':'notion_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'secret_[A-Za-z0-9]{43}', 'format_hint':'secret_[43 chars]', 'prefix_len':7}, {'name':'Airtable Personal Token', 'type':'airtable_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bpat[A-Za-z0-9]{14}\.[a-f0-9]{64}\b', 'format_hint':'pat[14].[64hex]', 'prefix_len':3}, {'name':'Mapbox Token', 'type':'mapbox_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'pk\.eyJ1[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+', 'format_hint':'pk.eyJ1...(Mapbox JWT)', 'prefix_len':3}, # ── E-Commerce ──────────────────────────────────────────────────────────── {'name':'Shopify Private App Token', 'type':'shopify_token', 'category':'Payment', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'shpat_[a-fA-F0-9]{32}', 'format_hint':'shpat_[32 hex]', 'prefix_len':6}, {'name':'Shopify Shared Secret', 'type':'shopify_secret', 'category':'Payment', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'shpss_[a-fA-F0-9]{32}', 'format_hint':'shpss_[32 hex]', 'prefix_len':6}, {'name':'WooCommerce Consumer Key', 'type':'woo_key', 'category':'Payment', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bck_[a-f0-9]{40}\b', 'format_hint':'ck_[40 hex]', 'prefix_len':3}, # ── Email Credentials ───────────────────────────────────────────────────── {'name':'Mail Password (ENV)', 'type':'mail_password', 'category':'Email Credentials', 'severity':'HIGH', 'confidence':'MEDIUM', 'pattern':r'(?i)(?:MAIL|EMAIL|SMTP)_(?:PASS(?:WORD)?|PWD)\s*[=:]\s*["\']?([^\s"\']{8,})["\']?', 'format_hint':'MAIL_PASSWORD=[8+ chars]', 'prefix_len':0}, {'name':'Gmail App Password', 'type':'gmail_app_pass', 'category':'Email Credentials', 'severity':'HIGH', 'confidence':'MEDIUM', 'pattern':r'(?i)(?:gmail|google)[^"\']{0,40}["\']([a-z]{4} [a-z]{4} [a-z]{4} [a-z]{4})["\']', 'format_hint':'xxxx xxxx xxxx xxxx (Gmail App Pass)', 'prefix_len':0}, {'name':'Email:Password Pair', 'type':'email_password', 'category':'Email Credentials', 'severity':'HIGH', 'confidence':'MEDIUM', 'pattern':r'[a-zA-Z0-9._%+\-]{3,40}@(?!github\.com|gitlab\.com|bitbucket\.org|example\.|test\.)[a-zA-Z0-9.\-]{3,}\.[a-z]{2,6}:(?!//)[A-Za-z0-9!#$%^&*()\-_+=]{8,64}', 'format_hint':'[email protected]:password', 'prefix_len':0}, ] 1 Quote
283 Posted June 24 Author Posted June 24 https://paste.me/paste/569138d9-936f-49c2-73ac-002f31d87ac8#f3a87e5e26fe8d7c5c5434188614c378031d12072edd7b95098a842f00ff4fa2 KI API Keys: 495 E-Mail Versand & SMS: 281 E-Mail Zugangsdaten: 1386 CRM & Analytics: 96 Monitoring & Observability: 121 Dev Tools, Auth & Cloud: 897 Social & Media Tokens: 26 Payment (Square, Razorpay, ...): 143 App-Geheimnisse (JWT / Session / Encrypt): 2088 Baut euch selber ein Checker und geht alles durch :) Ausbeute von 1 Tag :) Überlege eine Seite zu erstellen wo Livetime jeder Fund gepostet und validiert wird. Aber lohnt sich halt nicht da man damit kein Profit macht. 1 Quote
Machiavellixd Posted July 1 Posted July 1 an isch dope aber leider für ai keys fast nicht zubrauchen da diese sofort erkannt werden leider die haben da echt aufgerüstet, aber es gibt haufenweise sachen die man dort abgreifen kann die wirklich noch nützlich sind. 1 Quote Neuer Tg @Machiavellixd auf Telegram ! B2B B2C Kataloge Webseiten Unternehmen uvm // Partnerschaften oder Erwerb Qualitativer Mail Spam und API Transactional Mailsender.
Recommended Posts