search

bee-san / pyWhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️
MIT License
6.58k stars 349 forks source link

Add new RegEx for facebook tokens #225

Closed nodtem66 closed 2 years ago

nodtem66 commented 3 years ago

Prerequisites

Why do we need this pull request?

What GitHub issues does this fix?

Copy / paste of output

Please copy and paste the output of PyWhat with your new addition using an example that tests this addition below:

pywhat "12013331233|asdqwe12312312asdaslwke123asdalwfldfqwe"
<b>
Matched on: 12013331233|asdqwe12312312asdaslwke123asdalwfldfqwe
Name: Facebook App Token
Link:  https://developers.facebook.com/tools/debug/accesstoken/?access_token=12013331233|asdqwe12312312asdaslwke123asdal
wfldfqwe</b>
 pywhat "EAujR29N634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4uBV4n6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30NOXDVvUc20TuqH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt2yl1pGUmyPN6x79Dp1YqDv4seodn2"
Matched on: Pcagf55ZpzH5s4UZQBl49z0wbI6L4uBV4n6ugPUp6w
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/Pcagf55ZpzH5s4UZQBl49z0wbI6L4uBV4n6ugPUp6w

Matched on: Q4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30NOXDVvU
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/Q4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30NOXDVvU

Matched on: qH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Z
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/qH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Z

Matched on: EAujR29N634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4uBV4n6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30N
OXDVvUc20TuqH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt2yl1pGUmyPN6x79Dp1YqDv4seodn2
Name: Facebook Access Token
Link:  https://developers.facebook.com/tools/debug/accesstoken/?access_token=EAujR29N634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI
6L4uBV4n6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30NOXDVvUc20TuqH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt
2yl1pGUmyPN6x79Dp1YqDv4seodn2

Matched on: 3m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt
Name: Bitcoin (₿) Wallet Address
Link:  https://www.blockchain.com/btc/address/3m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt

Matched on: 1pGUmyPN6x79Dp1YqDv4seodn2
Name: Bitcoin (₿) Wallet Address
Link:  https://www.blockchain.com/btc/address/1pGUmyPN6x79Dp1YqDv4seodn2

Matched on: N634
Name: Latitude & Longitude Coordinates
Link:  https://www.google.com/maps/place/N634

Matched on: E743
Name: Latitude & Longitude Coordinates
Link:  https://www.google.com/maps/place/E743

Matched on: MDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/MDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4

Matched on: LyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSr
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/LyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSr

Matched on: m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt2
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt2

Matched on: R29N634fMDl1lPcagf55ZpzH5s4UZQBl49
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/R29N634fMDl1lPcagf55ZpzH5s4UZQBl49

Matched on: rj30NOXDVvUc20TuqH968ZYg253m96wMH2
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/rj30NOXDVvUc20TuqH968ZYg253m96wMH2

Matched on: rFMP4E7Zpt2yl1pGUmyPN6x79Dp1YqDv4s
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/rFMP4E7Zpt2yl1pGUmyPN6x79Dp1YqDv4s

Matched on: 634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4uB
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4uB&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify

Matched on: 6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUui
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUui&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify

Matched on: 6K1JKBSrj30NOXDVvUc20TuqH968ZYg253m96wMH
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=6K1JKBSrj30NOXDVvUc20TuqH968ZYg253m96wMH&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify
bee-san commented 3 years ago

@amadejpapez @piatrashkakanstantinass image

Those false positives though

nodtem66 commented 3 years ago

@bee-san I feel the same. I've tried the new RegEx, but it means nothing. Did you have any suggestions?

@piatrashkakanstantinass Yes

ghost commented 3 years ago

We have discussed this PR with the team, and it seems that your regexes can be improved. The access token regex should be ^(EAARE0ZA[0-9A-Za-z]{190,})$, this way it is more restrictive. You can ask questions on our discord so we can answer you faster.

nodtem66 commented 3 years ago

@bee-san @piatrashkakanstantinass Done

App token

> poetry run pywhat '1201566843289141|WG1OAKQ-dY0lSj5NKyA6uFkvF7w'
Matched on: 1201566843289
Name: Phone Number

Matched on: 120156684
Name: American Social Security Number
Description: An American Identification Number

Matched on: 1201566843289141|WG1OAKQ-dY0lSj5NKyA6uFkvF7w
Name: Facebook App Token
Link:
https://developers.facebook.com/tools/debug/accesstoken/?access_token=1201566843289141|WG1OAKQ-dY0lSj5NKyA6uFkvF7w

Matched on: 12015668432
Name: Turkish Identification Number

Access token

> poetry run pywhat --disable-boundaryless 'EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc'
Matched on: EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ
4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc
Name: Facebook Access Token
Link:  https://developers.facebook.com/tools/debug/accesstoken/?access_token=EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJu
OSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbq
ttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc
> poetry run pywhat 'EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc'
Matched on: PjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZC
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/PjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZC

Matched on: pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIg
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIg

Matched on: qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB

Matched on: S95
Name: Latitude & Longitude Coordinates
Link:  https://www.google.com/maps/place/S95

Matched on: m2L2aWdtNXOSscOnMYktEPYJuOSrteSQZC
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/m2L2aWdtNXOSscOnMYktEPYJuOSrteSQZC

Matched on: mEnju6XItaRhija3pA7LFPHquTbi4IDZC8
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/mEnju6XItaRhija3pA7LFPHquTbi4IDZC8

Matched on: MByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZ
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/MByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZ

Matched on: Mf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/Mf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB

Matched on: RE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYk
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/RE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYk

Matched on: rteSQZCh9VWVVKnhSSYNumEnju6XItaRhi
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/rteSQZCh9VWVVKnhSSYNumEnju6XItaRhi

Matched on: RDbqttxauxIDgBRYJ7zZABXe9V0CY872DU
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/RDbqttxauxIDgBRYJ7zZABXe9V0CY872DU

Matched on: 6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJ
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJ&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify

Matched on: 6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify

Matched on: EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ
4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc
Name: Facebook Access Token
Link:  https://developers.facebook.com/tools/debug/accesstoken/?access_token=EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJu
OSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbq
ttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc
codecov-commenter commented 2 years ago

Codecov Report

Merging #225 (b720538) into main (a5a4a3b) will not change coverage. The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##             main     #225   +/-   ##
=======================================
  Coverage   92.60%   92.60%           
=======================================
  Files          15       15           
  Lines        1217     1217           
=======================================
  Hits         1127     1127           
  Misses         90       90

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update a5a4a3b...b720538. Read the comment docs.

ghost commented 2 years ago

The regexes clearly have some false positives, so we should improve the output order, add interactive mode or something like that. @bee-san @amadejpapez thoughts?