From c3428df5dcb76c7820594d919acb479ef5f80491 Mon Sep 17 00:00:00 2001 From: Terrtia Date: Thu, 26 Apr 2018 14:42:39 +0200 Subject: [PATCH] add apiKeys module --- bin/ApiKey.py | 103 ++++++++++++++++++ bin/Categ.py | 2 +- bin/Credential.py | 7 +- bin/LAUNCH.sh | 4 +- bin/packages/modules.cfg | 8 +- files/ApiKey | 5 + .../templates/browse_important_paste.html | 4 + 7 files changed, 127 insertions(+), 6 deletions(-) create mode 100755 bin/ApiKey.py create mode 100644 files/ApiKey diff --git a/bin/ApiKey.py b/bin/ApiKey.py new file mode 100755 index 00000000..ff05fb84 --- /dev/null +++ b/bin/ApiKey.py @@ -0,0 +1,103 @@ +#!/usr/bin/env python3.5 +# -*-coding:UTF-8 -* + +""" +The ApiKey Module +====================== + +This module is consuming the Redis-list created by the Categ module. + +It apply API_key regexes on paste content and warn if above a threshold. + +""" + +import redis +import pprint +import time +import re + +from packages import Paste +from packages import lib_refine +from pubsublogger import publisher + +from Helper import Process + + +def search_api_key(message): + filename, score = message.split() + paste = Paste.Paste(filename) + content = paste.get_p_content() + + aws_access_key = regex_aws_access_key.findall(content) + aws_secret_key = regex_aws_secret_key.findall(content) + google_api_key = regex_google_api_key.findall(content) + + print(aws_access_key) + print(aws_secret_key) + print(google_api_key) + + if(len(aws_access_key) > 0 or len(aws_secret_key) > 0 or len(google_api_key) > 0): + + print('-------------------------------') + print(aws_access_key) + print(aws_secret_key) + print(google_api_key) + + to_print = 'ApiKey;{};{};{};'.format( + paste.p_source, paste.p_date, paste.p_name) + if(len(google_api_key) > 0): + print('found google api key') + print(to_print) + publisher.warning('{}Checked {} found Google API Key;{}'.format( + to_print, len(google_api_key), paste.p_path)) + + if(len(aws_access_key) > 0 or len(aws_secret_key) > 0): + print('found AWS key') + print(to_print) + total = len(aws_access_key) + len(aws_secret_key) + publisher.warning('{}Checked {} found AWS Key;{}'.format( + to_print, total, paste.p_path)) + + + msg = 'apikey;{}'.format(filename) + p.populate_set_out(msg, 'alertHandler') + #Send to duplicate + p.populate_set_out(filename, 'Duplicate') + +if __name__ == "__main__": + publisher.port = 6380 + publisher.channel = "Script" + + config_section = 'ApiKey' + + p = Process(config_section) + + publisher.info("ApiKey started") + + # REDIS # + r_serv2 = redis.StrictRedis( + host=p.config.get("Redis_Cache", "host"), + port=p.config.getint("Redis_Cache", "port"), + db=p.config.getint("Redis_Cache", "db")) + + message = p.get_from_set() + + # TODO improve REGEX + regex_aws_access_key = re.compile(r'(?SQL injections
  • CVEs
  • Keys
    • +
  • API Keys
  • Mails
  • Phones
  • Onions
    • @@ -112,6 +113,9 @@
    +
    + +