Adding AWS credential types

pywhat/Data/regex.json

@@ -189,22 +189,84 @@
          "Internet",
          "Networking",
          "AWS"
-      ]
-   },
-   {
-      "Name": "Internet Protocol (IP) Address Version 6",
-      "Regex": "^((?=.*[0-9])\\[?(?:(?:[0-9a-f]{1,4}:){7,7}[0-9a-f]{1,4}|([0-9a-f]{4}:){1,7}:|([0-9a-f]{1,4}:){1,6}:[0-9a-f]{1,4}|([0-9a-f]{1,4}:){1,5}(:[0-9a-f]{1,4}){1,2}|([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,3}|([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,4}|([0-9a-fA]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,5}|[0-9a-f]{1,4}:((:[0-9a-f]{1,4}){1,6})|:((:[0-9a-f]{1,4}){1,7}|:)|fe80:(:[0-9a-f]{0,4}){0,4}%[0-9a-z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-f]{1,4}:){1,4}:(?:(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\\]?(?::[0-9]{1,5})?)$",
+       ]
+    },
+    {
+      "Name": "Amazon Web Services Access Key",
+      "Regex": "(?<![A-Z0-9])[A-Z0-9]{20}(?![A-Z0-9])",
       "plural_name": false,
       "Description": null,
       "Rarity": 1,
-      "URL": "https://www.shodan.io/host/",
+      "URL": null,
+      "Tags": [
+         "Credentials",
+         "Cyber Security",
+         "AWS"
+       ]
+    },
+    {
+      "Name": "Amazon Web Services Secret Access Key",
+      "Regex": "^((?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=]))$",
+      "plural_name": false,
+      "Description": null,
+      "Rarity": 1,
+      "URL": null,
+      "Tags": [
+         "Credentials",
+         "Cyber Security",
+         "AWS"
+       ]
+    },
+    {
+      "Name": "Amazon Web Services EC2 Instance identifier",
+      "Regex": "(?i)^(\\b[a-z]+-[a-z0-9]+)$",
+      "plural_name": false,
+      "Description": null,
+      "Rarity": 0.5,
+      "URL": null,
       "Tags": [
          "Identifiers",
-         "Networking",
-         "IPv6"
-      ]
-   },
-   {
+         "AWS"
+       ]
+    },
+    {
+      "Name": "Amazon Web Services EC2 Security Group identifier",
+      "Regex": "^([0-9]*\/)?sg-([0-9]*)",
+      "plural_name": false,
+      "Description": null,
+      "Rarity": 0.5,
+      "URL": null,
+      "Tags": [
+         "Identifiers",
+         "AWS"
+       ]
+    },
+    {
+      "Name": "Amazon Web Services Organization identifier",
+      "Regex": "^o-[a-z0-9]{10,32}$",
+      "plural_name": false,
+      "Description": null,
+      "Rarity": 0.5,
+      "URL": null,
+      "Tags": [
+         "Identifiers",
+         "AWS"
+       ]
+    },
+    {
+       "Name": "Internet Protocol (IP) Address Version 6",
+       "Regex": "^((?=.*[0-9])\\[?(?:(?:[0-9a-f]{1,4}:){7,7}[0-9a-f]{1,4}|([0-9a-f]{4}:){1,7}:|([0-9a-f]{1,4}:){1,6}:[0-9a-f]{1,4}|([0-9a-f]{1,4}:){1,5}(:[0-9a-f]{1,4}){1,2}|([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,3}|([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,4}|([0-9a-fA]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,5}|[0-9a-f]{1,4}:((:[0-9a-f]{1,4}){1,6})|:((:[0-9a-f]{1,4}){1,7}|:)|fe80:(:[0-9a-f]{0,4}){0,4}%[0-9a-z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-f]{1,4}:){1,4}:(?:(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\\]?(?::[0-9]{1,5})?)$",
+       "plural_name": false,
+       "Description": null,
+       "Rarity": 1,
+       "URL": "https://www.shodan.io/host/",
+       "Tags": [
+          "Identifiers",
+          "Networking",
+          "IPv6"
+       ]
+    },
+    {
       "Name": "Google API Key",
       "Regex": "^(AIza[0-9A-Za-z-_]{35})$",
       "plural_name": false,
@@ -243,20 +305,7 @@
          "Google"
       ]
    },
-   {
-      "Name": "AWS Access Key ID",
-      "Regex": "^(A[SK]IA[0-9A-Z]{16})$",
-      "plural_name": false,
-      "Description": null,
-      "Rarity": 1,
-      "URL": null,
-      "Tags": [
-         "API Keys",
-         "Credentials",
-         "AWS"
-      ]
-   },
-   {
+    {
       "Name": "Mailgun API Key",
       "Regex": "^(key-[0-9a-zA-Z]{32})$",
       "plural_name": false,

tests/test_regex_identifier.py

@@ -589,6 +589,30 @@ def test_ssh_ed25519_key():
     )
     assert "SSH ED25519" in str(res)
 
+def test_aws_access_key():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["AKIAIOSFODNN7EXAMPLE"])
+    assert "Amazon Web Services Access Key" in str(res)
+
+def test_aws_secret_access_key():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["Nw0XP0t2OdyUkaIk3B8TaAa2gEXAMPLEMvD2tW+g"])
+    assert "Amazon Web Services Secret Access Key" in str(res)
+
+def test_aws_ec2_id():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["i-1234567890abcdef0"])
+    assert "Amazon Web Services EC2 Instance identifier" in str(res)
+
+def test_aws_sg_id():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["sg-6e616f6d69"])
+    assert "Amazon Web Services EC2 Security Group identifier" in str(res)
+
+def test_aws_org_id():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["o-aa111bb222"])
+    assert "Amazon Web Services Organization identifier" in str(res)
 
 def test_asin():
     r = regex_identifier.RegexIdentifier()
@@ -599,7 +623,6 @@ def test_asin():
     )
     assert "ASIN" in str(res)
 
-
 def test_google_api_key():
     r = regex_identifier.RegexIdentifier()
     res = r.check(["AIzaSyD7CQl6fRhagGok6CzFGOOPne2X1u1spoA"])
@@ -621,13 +644,13 @@ def test_google_oauth_token():
 def test_aws_access_key_id():
     r = regex_identifier.RegexIdentifier()
     res = r.check(["AKIA31OMZKYAARWZ3ERH"])
-    _assert_match_first_item("AWS Access Key ID", res)
+    _assert_match_first_item("Amazon Web Services Access Key", res)
 
 
 def test_mailgun_api_key():
     r = regex_identifier.RegexIdentifier()
     res = r.check(["key-1e1631a9414aff7c262721e7b6ff6e43"])
-    _assert_match_first_item("Mailgun API Key", res)
+    assert "Mailgun API Key" in res[1]["Regex Pattern"]["Name"]
 
 
 def test_twilio_api_key():