General tokens

General tokens

tokens/general-tokens.yaml

@@ -0,0 +1,29 @@
+id: general-tokens
+
+#this will create a huge load of false positive
+
+info:
+  name: General Tokens
+  author: nadino
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers:
+      - type: dsl
+        dsl:
+        - 'regex("TOKEN(\")?(:|=)+(\")?",replace(toupper(body)," ",""))'                    #any TOKEN word
+        - 'regex("API(\\-|_| )+([A-Z]{3})+(\")?(:|=)+(\")?",replace(toupper(body)," ",""))' #API_XXX...
+        - 'regex("([A-Z]{3})+(\\-|_| )+API(\")?(:|=)+(\")?",replace(toupper(body)," ",""))' #XXX_API
+        - 'regex("([A-Z]{3})+(\\-|_| )+KEY(\")?(:|=)+(\")?",replace(toupper(body)," ",""))' #XXX_KEY    
+        - 'regex("KEY(\\-|_| )+([A-Z]{3})+(\")?(:|=)+(\")?",replace(toupper(body)," ",""))' #KEY_XXX
+        - 'regex("SECRET(\")?(:|=)+(\")?",replace(toupper(body)," ",""))'                   #any SECRET word
+        - 'regex("AUTHORIZATION(\")?(:|=)+(\")?",replace(toupper(body)," ",""))'            #any AUTHORIZATION word
+        - 'regex("PASSWORD(\")?(:|=)+(\")?",replace(toupper(body)," ",""))'                 #any PASSWORD word
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "TOKEN(\")?(:|=)+(\")?"