Add a ton of detections

ryanlabouve · ryanlabouve · commit 6f9cd3d2015d · 2024-07-04T00:39:27.000-05:00
diff --git a/detections/bank_iban.toml b/detections/bank_iban.toml
@@ -0,0 +1,8 @@
+[secret_type]
+name = "bank_iban"
+regex = "[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}([A-Z0-9]?){0,16}"
+description = "Detects International Bank Account Numbers (IBAN)"
+
+examples = ["GB29NWBK60161331926819", "DE91100000000123456789"]
+
+false_positives = ["AB12CD34EF56GH78IJ90KL"]
diff --git a/detections/bank_switf.toml b/detections/bank_switf.toml
@@ -0,0 +1,6 @@
+[secret_type]
+name = "bank_swift"
+regex = "^[A-Z]{6}[A-Z0-9]{2}([A-Z0-9]{3})?$"
+description = "Detects bank SWIFT/BIC codes"
+examples = ["DEUTDEFF", "NEDSZAJJXXX", "DABADKKK", "UNCRIT2B912"]
+false_positives = ["SWIFT123", "BICCODE12XXX"]
diff --git a/detections/bitcoin_wallet.toml b/detections/bitcoin_wallet.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "bitcoin_wallet"
+regex = "([13][a-km-zA-HJ-NP-Z1-9]{25,34})"
+description = "Detects Bitcoin wallet addresses"
+
+examples = [
+    "1BoatSLRHtKNngkdXEeobR76b53LETtpyT",
+    "3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy",
+]
+
+false_positives = []
diff --git a/detections/credit_card.toml b/detections/credit_card.toml
@@ -0,0 +1,13 @@
+[secret_type]
+name = "credit_card"
+regex = "(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9]{2})[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\\d{3})\\d{11})"
+description = "Detects credit card numbers"
+
+examples = [
+    "4111111111111111",
+    "5500000000000004",
+    "340000000000009",
+    "30000000000004",
+]
+
+false_positives = []
diff --git a/detections/db_connection_string.toml b/detections/db_connection_string.toml
@@ -0,0 +1,13 @@
+[secret_type]
+regex = "(jdbc:sqlserver|mysql|postgresql|oracle):\\/\\/[a-zA-Z0-9_\\-\\.]+:[a-zA-Z0-9_\\-\\.]*@[a-zA-Z0-9_\\-\\.]+:\\d{2,5}\\/[a-zA-Z0-9_\\-]+"
+name = "db_connection_string"
+description = "Detects database connection strings"
+
+examples = [
+    "jdbc:sqlserver://username:password@localhost:1433/databaseName",
+    "mysql://user:pass@db-host:3306/dbname",
+    "postgresql://admin:secret@db-server:5432/db_instance",
+    "oracle://dbuser:dbpass@oraclehost:1521/orcl",
+]
+
+false_positives = []
diff --git a/detections/digital_ocean.toml b/detections/digital_ocean.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "digital_ocean_token"
+regex = "[a-fA-F0-9]{64}"
+description = "Detects Digital Ocean personal access tokens"
+
+examples = [
+    "b7d03a6947b217efb6f3ec3bd3504582b3e57f8e9a2a8aeae0988e1a46df7e2c",
+    "f3bb3b0cd2abc0d4b0b0e8e8c3f044c70c60ded4c8a204a8886fa8b75421255c",
+]
+
+false_positives = []
diff --git a/detections/drivers_license.toml b/detections/drivers_license.toml
@@ -0,0 +1,8 @@
+[secret_type]
+name = "drivers_license"
+regex = "[A-Z]{1,2}[0-9]{6,9}"
+description = "Detects driver's license numbers"
+
+examples = ["S1234567", "AB123456789"]
+
+false_positives = []
diff --git a/detections/elasticsearch_connection_string.toml b/detections/elasticsearch_connection_string.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "elasticsearch_connection_string"
+regex = "https?://[a-zA-Z0-9\\-\\.]+:[a-zA-Z0-9\\-\\.]+@[a-zA-Z0-9\\-\\.]+:\\d{2,5}/[a-zA-Z0-9_\\-]+"
+description = "Detects Elasticsearch connection strings"
+
+examples = [
+    "http://username:password@localhost:9200/indexname",
+    "https://user:pass@es-domain:443/index",
+]
+
+false_positives = []
diff --git a/detections/eth_wallet.toml b/detections/eth_wallet.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "eth_wallet"
+regex = "0x[a-fA-F0-9]{40}"
+description = "Detects Ethereum wallet addresses"
+
+examples = [
+    "0x27b1fdb04752bbc536007a920d24acb045561c26",
+    "0x4e83362442b8d1bec281594cea3050c8eb01311c",
+]
+
+false_positives = ["1x1234567890123456789012345678901234567890"]
diff --git a/detections/facebook_access_token.toml b/detections/facebook_access_token.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "facebook_access_token"
+regex = "EAACEdEose0cBA[0-9A-Za-z]+"
+description = "Detects Facebook Access Tokens"
+
+examples = [
+    "EAACEdEose0cBAKLsJZCZCZCZCZ",
+    "EAACEdEose0cBAPZAnZCqZDZDZDZ",
+    "EAACEdEose0cBAAZBnZCwZCZCZCZ",
+]
+false_positives = []
diff --git a/detections/google_api_key.toml b/detections/google_api_key.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "google_api_key"
+regex = "AIza[0-9A-Za-z\\-_]{35}"
+description = "Detects Google API keys"
+
+examples = [
+    "AIzaSyB-1234567890QWERTYUIOPSDFGHJKLZXCVB",
+    "AIzaSyC-0987654321ASDFGHJKLQWERTYUIOZXCVB",
+]
+
+false_positives = []
diff --git a/detections/heroku_api_key.toml b/detections/heroku_api_key.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "heroku_api_key"
+regex = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
+description = "Detects Heroku API keys"
+
+examples = [
+    "1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
+    "e2d9b4e2-5b68-11eb-ae93-0242ac130002",
+]
+
+false_positives = []
diff --git a/detections/ip_address.toml b/detections/ip_address.toml
@@ -0,0 +1,8 @@
+[secret_type]
+name = "ip_address"
+regex = "(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"
+description = "Detects IP addresses"
+
+examples = ["192.168.1.1", "10.0.0.1"]
+
+false_positives = ["9a9.999.999.999"]
diff --git a/detections/jira_api_token.toml b/detections/jira_api_token.toml
@@ -0,0 +1,8 @@
+[secret_type]
+name = "jira_api_token"
+regex = "[A-Za-z0-9]{24}"
+description = "Detects JIRA API tokens"
+
+examples = ["a1b2c3d4e5f6g7h8i9j0k1l2", "m3n4o5p6q7r8s9t0u1v2w3x4"]
+
+false_positives = []
diff --git a/detections/jwt.toml b/detections/jwt.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "jwt"
+regex = "[A-Za-z0-9-_=]+\\.[A-Za-z0-9-_=]+\\.?[A-Za-z0-9-_.+/=]*"
+description = "Detects JSON Web Tokens (JWTs)"
+
+examples = [
+    "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
+    "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.4M7kx6kAL0HqXpTn5Ia7Y5B3Zm7h3yZX0kF0FgzLZgA",
+]
+
+false_positives = []
diff --git a/detections/mailchimp_api_key.toml b/detections/mailchimp_api_key.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "mailchimp_api_key"
+regex = "[0-9a-fA-F]{32}-us[0-9]{1,2}"
+description = "Detects MailChimp API keys"
+
+examples = [
+    "4e9a2bac28eb6251d2b0c7575d4e1e12-us3",
+    "8b74213b1f342bf3e78010c8d7a4a8b5-us2",
+]
+
+false_positives = []
diff --git a/detections/oauth_token.toml b/detections/oauth_token.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "oauth_token"
+regex = "[A-Za-z0-9]{32}"
+description = "Detects OAuth tokens"
+
+examples = [
+    "a3b4c6d7e8f9g0h1j2k3l4m5n6o7p8q9",
+    "1234567890abcdef1234567890abcdef",
+]
+
+false_positives = []
diff --git a/detections/passport_number.toml b/detections/passport_number.toml
@@ -0,0 +1,8 @@
+[secret_type]
+name = "passport_number"
+regex = "[A-Z0-9]{2}-[0-9]{7}"
+description = "Detects passport numbers"
+
+examples = ["AB-1234567", "CD-8901234"]
+
+false_positives = []
diff --git a/detections/paypal_api_key.toml b/detections/paypal_api_key.toml
@@ -0,0 +1,8 @@
+[secret_type]
+name = "paypal_api_key"
+regex = "[A-Za-z0-9]{20}"
+description = "Detects PayPal API keys"
+
+examples = ["A21AAHKXU8B9J0KU2CDA", "A21AAHJASD2GJ0KU3BDB"]
+
+false_positives = []
diff --git a/detections/phone_number.toml b/detections/phone_number.toml
@@ -0,0 +1,14 @@
+[secret_type]
+name = "phone_number"
+regex = "^\\+?(\\d{1,4})?[-.\\s]?\\(?\\d{1,4}\\)?[-.\\s]?\\d{1,9}[-.\\s]?\\d{1,9}$"
+description = "Detects various formats of phone numbers including international and local formats."
+
+examples = [
+    "123-456-7890",
+    "+1-123-456-7890",
+    "+1 123 456 7890",
+    "1234567890",
+    "+11234567890",
+]
+
+false_positives = []
diff --git a/detections/pypi_api_token.toml b/detections/pypi_api_token.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "pypi_api_token"
+regex = "pypi-AgEIcHlwaS5vcmc[A-Za-z0-9]{50,}"
+description = "Detects PyPI API tokens"
+
+examples = [
+    "pypi-AgEIcHlwaS5vcmcCJDJkODdlYmE4LWE5MjQtNGUxMS1iYWY4LWJmNjg4YTQ2ZmJlZgACOXsicGVybWlzc2lvbnMiOiAidXNlciI",
+    "pypi-AgEIcHlwaS5vcmcCJDJkODdlYmE4LWE5MjQtNGUxMS1iYWY4LWJmNjg4YTQ2ZmJlZgACOXsicGVybWlzc2lvbnMiOiAidXNlciI",
+]
+
+false_positives = []
diff --git a/detections/redis_connection_url.toml b/detections/redis_connection_url.toml
@@ -0,0 +1,12 @@
+[secret_type]
+name = "redis_connection_string"
+regex = "redis://(:?[:\\w]*@)?\\w+(:\\d+)?"
+description = "Detects Redis connection strings"
+
+examples = [
+    "redis://user:password@localhost:6379",
+    "redis://:password@localhost:6379",
+    "redis://localhost:6379",
+]
+
+false_positives = []
diff --git a/detections/slack_token.toml b/detections/slack_token.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "slack_token"
+regex = "[xoxb|xoxp|xoxa|xoxr]-[0-9]{10,12}-[0-9]{10,12}-[0-9a-zA-Z]{24,32}"
+description = "Detects Slack API tokens"
+
+examples = [
+    "xoxb-123456789012-123456789012-3aBcDeFgHiJkLmNoPqRsTuVwXyZ012345678",
+    "xoxp-210987654321-109876543210-a1B2c3D4e5F6g7H8i9J0kLmN1oP2qR3sT4uV5",
+]
+
+false_positives = []
diff --git a/detections/ssh_keys.toml b/detections/ssh_keys.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "ssh_key"
+regex = "ssh-rsa [A-Za-z0-9+/]+[=]{0,3}( [^@]+@[^@]+)?"
+description = "Detects SSH public keys"
+
+examples = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3b3C7xAd5D6m6N+H4B+b5+P+Mj5SLGACd0...",
+    "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuelZMnPIHPca8MlrBb8M...",
+]
+
+false_positives = []
diff --git a/detections/stripe_api_key.toml b/detections/stripe_api_key.toml
@@ -0,0 +1,11 @@
+[secret_type]
+name = "stripe_api_key"
+regex = "sk_live_[0-9a-zA-Z]{24}"
+description = "Detects Stripe API keys"
+
+examples = [
+    "sk_live_4eC39HqLyjWDarjtT1zdp7dc",
+    "sk_live_BQokikJOvBiI2HlWgH4olfQ2",
+]
+
+false_positives = []
diff --git a/detections/twitter_api_key.toml b/detections/twitter_api_key.toml
@@ -0,0 +1,8 @@
+[secret_type]
+name = "twitter_api_key"
+regex = "[1-9a-zA-Z]{25}"
+description = "Detects Twitter API keys"
+
+examples = ["XvZ2N1vaW5zI1NDbGJWdQ3R1bWV0cg", "M1dDMzZPcEdHYnRUU2xGVVBR2dZR2h"]
+
+false_positives = []
diff --git a/detections/vin.toml b/detections/vin.toml
@@ -0,0 +1,8 @@
+[secret_type]
+name = "vin"
+regex = "[A-HJ-NPR-Z0-9]{17}"
+description = "Detects vehicle identification numbers (VINs)"
+
+examples = ["1HGCM82633A004352", "JH4KA7660MC000000"]
+
+false_positives = []
diff --git a/src/secret_type/mod.rs b/src/secret_type/mod.rs
@@ -38,16 +38,21 @@ impl SecretType {
         // 2. Ensure that all examples match the regex
         for example in &self.examples {
             if !re.is_match(example) {
-                return Err(format!("Example '{}' does not match the regex", example));
+                return Err(format!(
+                    "Example '{}' does not match the regex '{}' for secret type '{}'",
+                    example, self.regex, self.name
+                ));
             }
         }
 
         // 3. Ensure that all false positives do not match the regex
         for false_positive in &self.false_positives {
             if re.is_match(false_positive) {
                 return Err(format!(
-                    "False positive '{}' matches the regex",
-                    false_positive
+                    "False positive '{}' matches the regex '{}' for secret type '{}'",
+                    false_positive,
+                    self.regex,
+                    self.name // End of  Selection
                 ));
             }
         }
