diff --git a/CHANGELOG.md b/CHANGELOG.md index 059d96630..bf117e698 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - Docker Hub Personal Access Token ([#108](https://github.com/praetorian-inc/noseyparker/pull/108) - thank you @gemesa!) - Dropbox Access Token ([#106](https://github.com/praetorian-inc/noseyparker/pull/106) - thank you @gemesa!) + - TrueNAS API Key (WebSocket) + - TrueNAS API Key (REST API) - WireGuard Private Key ([#104](https://github.com/praetorian-inc/noseyparker/pull/104) - thank you @gemesa!) - WireGuard Preshared Key ([#104](https://github.com/praetorian-inc/noseyparker/pull/104) - thank you @gemesa!) diff --git a/README.md b/README.md index a0dd626f8..ef42ddc6b 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Nosey Parker is a command-line tool that finds secrets and sensitive information **Key features:** - It supports scanning files, directories, and the entire history of Git repositories -- It uses regular expression matching with a set of 118 patterns chosen for high signal-to-noise based on experience and feedback from offensive security engagements +- It uses regular expression matching with a set of 120 patterns chosen for high signal-to-noise based on experience and feedback from offensive security engagements - It groups matches together that share the same secret, further emphasizing signal over noise - It is fast: it can scan at hundreds of megabytes per second on a single core, and is able to scan 100GB of Linux kernel source history in less than 2 minutes on an older MacBook Pro diff --git a/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_check_builtins-2.snap b/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_check_builtins-2.snap index 1b5ac4481..507899da7 100644 --- a/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_check_builtins-2.snap +++ b/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_check_builtins-2.snap @@ -2,5 +2,5 @@ source: crates/noseyparker-cli/tests/rules/mod.rs expression: stdout --- -118 rules and 3 rulesets: no issues detected +120 rules and 3 rulesets: no issues detected diff --git a/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_json-2.snap b/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_json-2.snap index 09390ef4a..38e360f03 100644 --- a/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_json-2.snap +++ b/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_json-2.snap @@ -456,6 +456,14 @@ expression: stdout "id": "np.telegram.1", "name": "Telegram Bot Token" }, + { + "id": "np.truenas.1", + "name": "TrueNAS API Key (WebSocket)" + }, + { + "id": "np.truenas.2", + "name": "TrueNAS API Key (REST API)" + }, { "id": "np.twilio.1", "name": "Twilio API Key" @@ -481,7 +489,7 @@ expression: stdout { "id": "default", "name": "Nosey Parker default rules", - "num_rules": 98 + "num_rules": 100 }, { "id": "np.assets", diff --git a/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_noargs-2.snap b/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_noargs-2.snap index 9a1bd0cd6..1c695cd75 100644 --- a/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_noargs-2.snap +++ b/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_noargs-2.snap @@ -118,6 +118,8 @@ expression: stdout np.stripe.1 Stripe API Key np.stripe.2 Stripe API Test Key np.telegram.1 Telegram Bot Token + np.truenas.1 TrueNAS API Key (WebSocket) + np.truenas.2 TrueNAS API Key (REST API) np.twilio.1 Twilio API Key np.twitter.1 Twitter Client ID np.twitter.2 Twitter Secret Key @@ -126,7 +128,7 @@ expression: stdout Ruleset ID Ruleset Name Rules ───────────────────────────────────────────────────────── - default Nosey Parker default rules 98 + default Nosey Parker default rules 100 np.assets Nosey Parker asset detection rules 15 np.hashes Nosey Parker password hash rules 5 diff --git a/crates/noseyparker/data/default/builtin/rules/truenas.yml b/crates/noseyparker/data/default/builtin/rules/truenas.yml new file mode 100644 index 000000000..767439e59 --- /dev/null +++ b/crates/noseyparker/data/default/builtin/rules/truenas.yml @@ -0,0 +1,53 @@ +rules: + +- name: TrueNAS API Key (WebSocket) + id: np.truenas.1 + + pattern: | + (?x) + "params"\s*:\s*\[\s*" + (\d+-[a-zA-Z0-9]{64}) + "\s*\] + + examples: + - '{"id":"3286a508-a6ca-278a-c078-85b2b515d8d2", "msg":"method", "method":"auth.login_with_api_key", "params":["8-Lp22ov7halMBLUpG97Wg4y7fibQi3CW19VJiZcCu746zgCs0mdDdTCoOcpgEucgu"]}' + - '{"id":"677d9914-f598-f497-e77e-2a3aadbb822e", "msg":"method", "method":"auth.login_with_api_key", "params" : ["9-hTSZDBPyg0PjRZvWb8omoxJ7X2gAjRGmiPKql9ENGIUP9OPtEAzz5f6g9YIMVbZT"]}' + - '{"id":"2755dad4-cc12-94bb-a894-ba0f85c3fdbf", "msg":"method", "method":"auth.login_with_api_key", "params" : [ "10-6LZBVhNq8zze0rzXJptfSWDBoskWuThnQb3fUVw4sVNgJ7GKT3ITVIovhwPf34oL" ]}' + - | + { + "id": "2755dad4-cc12-94bb-a894-ba0f85c3fdbf", + "msg": "method", + "method": "auth.login_with_api_key", + "params": [ + "10-6LZBVhNq8zze0rzXJptfSWDBoskWuThnQb3fUVw4sVNgJ7GKT3ITVIovhwPf34oL" + ] + } + + references: + - https://www.truenas.com/docs/api/core_websocket_api.html + - https://www.truenas.com/docs/api/scale_rest_api.html + - https://www.truenas.com/docs/scale/scaletutorials/toptoolbar/managingapikeys/ + - https://www.truenas.com/docs/scale/scaleclireference/auth/cliapikey/ + - https://www.truenas.com/docs/scale/api/ + - https://www.truenas.com/community/threads/api-examples-in-perl-python.108053/ + +- name: TrueNAS API Key (REST API) + id: np.truenas.2 + + pattern: | + (?x) + Bearer\s* + (\d+-[a-zA-Z0-9]{64}) + \b + + examples: + # only "Bearer" is accepted by TrueNAS API (no "bearer" etc.) + - 'curl -X POST "http://192.168.0.30/api/v2.0/device/get_info" -H "Content-Type: application/json" -H "Authorization: Bearer 8-Lp22ov7halMBLUpG97Wg4y7fibQi3CW19VJiZcCu746zgCs0mdDdTCoOcpgEucgu" -d "\"SERIAL\""' + + references: + - https://www.truenas.com/docs/api/core_websocket_api.html + - https://www.truenas.com/docs/api/scale_rest_api.html + - https://www.truenas.com/docs/scale/scaletutorials/toptoolbar/managingapikeys/ + - https://www.truenas.com/docs/scale/scaleclireference/auth/cliapikey/ + - https://www.truenas.com/docs/scale/api/ + - https://www.truenas.com/community/threads/api-examples-in-perl-python.108053/ diff --git a/crates/noseyparker/data/default/builtin/rulesets/default.yml b/crates/noseyparker/data/default/builtin/rulesets/default.yml index 2bde94533..d98f4bb22 100644 --- a/crates/noseyparker/data/default/builtin/rulesets/default.yml +++ b/crates/noseyparker/data/default/builtin/rulesets/default.yml @@ -109,6 +109,8 @@ rulesets: - np.stripe.1 # Stripe API Key - np.stripe.2 # Stripe API Test Key - np.telegram.1 # Telegram Bot Token + - np.truenas.1 # TrueNAS API Key (WebSocket) + - np.truenas.2 # TrueNAS API Key (REST API) - np.twilio.1 # Twilio API Key - np.twitter.2 # Twitter Secret Key - np.wireguard.1 # WireGuard Private Key