Add new RegEx for facebook tokens by nodtem66 · Pull Request #225 · bee-san/pyWhat

nodtem66 · 2021-11-01T23:23:15Z

Prerequisites

Have you read the documentation on contributing? https://github.com/bee-san/pyWhat/wiki/Adding-your-own-Regex

Why do we need this pull request?

Add new RegEx and tests for facebook app tokens and access token
based on v12 API
https://developers.facebook.com/docs/facebook-login/access-tokens/

What GitHub issues does this fix?

Fixes Find / add tests for API keys! #150

Copy / paste of output

Please copy and paste the output of PyWhat with your new addition using an example that tests this addition below:

pywhat "12013331233|asdqwe12312312asdaslwke123asdalwfldfqwe"
<b>
Matched on: 12013331233|asdqwe12312312asdaslwke123asdalwfldfqwe
Name: Facebook App Token
Link:  https://developers.facebook.com/tools/debug/accesstoken/?access_token=12013331233|asdqwe12312312asdaslwke123asdal
wfldfqwe</b>

 pywhat "EAujR29N634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4uBV4n6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30NOXDVvUc20TuqH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt2yl1pGUmyPN6x79Dp1YqDv4seodn2"
Matched on: Pcagf55ZpzH5s4UZQBl49z0wbI6L4uBV4n6ugPUp6w
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/Pcagf55ZpzH5s4UZQBl49z0wbI6L4uBV4n6ugPUp6w

Matched on: Q4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30NOXDVvU
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/Q4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30NOXDVvU

Matched on: qH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Z
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/qH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Z

Matched on: EAujR29N634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4uBV4n6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30N
OXDVvUc20TuqH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt2yl1pGUmyPN6x79Dp1YqDv4seodn2
Name: Facebook Access Token
Link:  https://developers.facebook.com/tools/debug/accesstoken/?access_token=EAujR29N634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI
6L4uBV4n6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSrj30NOXDVvUc20TuqH968ZYg253m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt
2yl1pGUmyPN6x79Dp1YqDv4seodn2

Matched on: 3m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt
Name: Bitcoin (₿) Wallet Address
Link:  https://www.blockchain.com/btc/address/3m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt

Matched on: 1pGUmyPN6x79Dp1YqDv4seodn2
Name: Bitcoin (₿) Wallet Address
Link:  https://www.blockchain.com/btc/address/1pGUmyPN6x79Dp1YqDv4seodn2

Matched on: N634
Name: Latitude & Longitude Coordinates
Link:  https://www.google.com/maps/place/N634

Matched on: E743
Name: Latitude & Longitude Coordinates
Link:  https://www.google.com/maps/place/E743

Matched on: MDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/MDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4

Matched on: LyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSr
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/LyQ4mFx2xp56N0vXqwUuixvlMP6K1JKBSr

Matched on: m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt2
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/m96wMH2uK8tKE743hAJ747yrFMP4E7Zpt2

Matched on: R29N634fMDl1lPcagf55ZpzH5s4UZQBl49
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/R29N634fMDl1lPcagf55ZpzH5s4UZQBl49

Matched on: rj30NOXDVvUc20TuqH968ZYg253m96wMH2
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/rj30NOXDVvUc20TuqH968ZYg253m96wMH2

Matched on: rFMP4E7Zpt2yl1pGUmyPN6x79Dp1YqDv4s
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/rFMP4E7Zpt2yl1pGUmyPN6x79Dp1YqDv4s

Matched on: 634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4uB
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=634fMDl1lPcagf55ZpzH5s4UZQBl49z0wbI6L4uB&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify


Matched on: 6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUui
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=6ugPUp6whoIco3dI0uOLyQ4mFx2xp56N0vXqwUui&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify


Matched on: 6K1JKBSrj30NOXDVvUc20TuqH968ZYg253m96wMH
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=6K1JKBSrj30NOXDVvUc20TuqH968ZYg253m96wMH&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify

- Add new RegEx and tests for facebook app tokens and access token based on v12 API https://developers.facebook.com/docs/facebook-login/access-tokens/

bee-san · 2021-11-02T14:10:26Z

@amadejpapez @piatrashkakanstantinass

Those false positives though

ghost

Can you remove the fixture/file additions and tests added to test_click.py? Also, I think that the rarity of both these regexes should be lowered since false positives are highly likely.

nodtem66 · 2021-11-03T05:36:43Z

@bee-san I feel the same.
I've tried the new RegEx, but it means nothing.
Did you have any suggestions?

@piatrashkakanstantinass Yes

- Remove testcases from fixtures/file and test_click.py - Adjust the rarity of Access token and App token to 0.2 and 0.3, respectively

ghost · 2021-11-03T10:46:26Z

We have discussed this PR with the team, and it seems that your regexes can be improved. The access token regex should be ^(EAARE0ZA[0-9A-Za-z]{190,})$, this way it is more restrictive. You can ask questions on our discord so we can answer you faster.

nodtem66 · 2021-11-03T10:54:00Z

@bee-san @piatrashkakanstantinass Done

Remove test cases from fixtures/file and test_click.py
Adjust the rarity of Access token and App token to 0.2 and 0.3,
respectively.

The access token is broad, almost no specific characters, matching the rarity of 0.2
Likewise, the app token has only a few specific characters (the letter | in the middle), matching the rarity of 0.3

App token

> poetry run pywhat '1201566843289141|WG1OAKQ-dY0lSj5NKyA6uFkvF7w'
Matched on: 1201566843289
Name: Phone Number

Matched on: 120156684
Name: American Social Security Number
Description: An American Identification Number

Matched on: 1201566843289141|WG1OAKQ-dY0lSj5NKyA6uFkvF7w
Name: Facebook App Token
Link:
https://developers.facebook.com/tools/debug/accesstoken/?access_token=1201566843289141|WG1OAKQ-dY0lSj5NKyA6uFkvF7w

Matched on: 12015668432
Name: Turkish Identification Number

Access token

> poetry run pywhat --disable-boundaryless 'EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc'
Matched on: EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ
4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc
Name: Facebook Access Token
Link:  https://developers.facebook.com/tools/debug/accesstoken/?access_token=EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJu
OSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbq
ttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc

> poetry run pywhat 'EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc'
Matched on: PjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZC
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/PjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZC

Matched on: pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIg
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIg

Matched on: qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB
Name: Bitcoin Cash (BCH) Wallet Address
Link:  https://www.blockchain.com/bch/address/qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB

Matched on: S95
Name: Latitude & Longitude Coordinates
Link:  https://www.google.com/maps/place/S95

Matched on: m2L2aWdtNXOSscOnMYktEPYJuOSrteSQZC
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/m2L2aWdtNXOSscOnMYktEPYJuOSrteSQZC

Matched on: mEnju6XItaRhija3pA7LFPHquTbi4IDZC8
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/mEnju6XItaRhija3pA7LFPHquTbi4IDZC8

Matched on: MByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZ
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/MByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZ

Matched on: Mf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB
Name: Litecoin (LTC) Wallet Address
Link:  https://live.blockcypher.com/ltc/address/Mf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB

Matched on: RE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYk
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/RE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYk

Matched on: rteSQZCh9VWVVKnhSSYNumEnju6XItaRhi
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/rteSQZCh9VWVVKnhSSYNumEnju6XItaRhi

Matched on: RDbqttxauxIDgBRYJ7zZABXe9V0CY872DU
Name: Ripple (XRP) Wallet Address
Link:  https://xrpscan.com/account/RDbqttxauxIDgBRYJ7zZABXe9V0CY872DU

Matched on: 6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJ
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJ&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify


Matched on: 6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB
Name: Google ReCaptcha API Key
Exploit: Use the command below to verify that API key is valid:
  $ curl -X POST -d "secret=6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgB&response=RESPONSE_TO_VERIFY"
https://www.google.com/recaptcha/api/siteverify


Matched on: EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJuOSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ
4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbqttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc
Name: Facebook Access Token
Link:  https://developers.facebook.com/tools/debug/accesstoken/?access_token=EAARE0ZATePjUBAFxfm2L2aWdtNXOSscOnMYktEPYJu
OSrteSQZCh9VWVVKnhSSYNumEnju6XItaRhija3pA7LFPHquTbi4IDZC8k9EMByeQ4NJzCFsc40FMIQIgvnCTOK5qt6xBZCUMf7S95X6nnqCUVw2iS0DRDbq
ttxauxIDgBRYJ7zZABXe9V0CY872DUl3BfyINIYfCXmRZC8loACc

codecov-commenter · 2021-11-07T11:19:55Z

Codecov Report

Merging #225 (b720538) into main (a5a4a3b) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #225   +/-   ##
=======================================
  Coverage   92.60%   92.60%           
=======================================
  Files          15       15           
  Lines        1217     1217           
=======================================
  Hits         1127     1127           
  Misses         90       90

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a5a4a3b...b720538. Read the comment docs.

ghost · 2021-11-10T10:49:25Z

The regexes clearly have some false positives, so we should improve the output order, add interactive mode or something like that. @bee-san @amadejpapez thoughts?

Add new RegEx for facebook tokens

0059269

- Add new RegEx and tests for facebook app tokens and access token based on v12 API https://developers.facebook.com/docs/facebook-login/access-tokens/

ghost suggested changes Nov 2, 2021

View reviewed changes

Remove testcases and adjust the rarity

75a9464

- Remove testcases from fixtures/file and test_click.py - Adjust the rarity of Access token and App token to 0.2 and 0.3, respectively

Merge branch 'main' into main

b720538

Merge branch 'main' into main

6f7f891

ghost enabled auto-merge November 10, 2021 10:47

ghost disabled auto-merge November 10, 2021 10:47

ghost approved these changes Nov 10, 2021

View reviewed changes

ghost merged commit 69da611 into bee-san:main Nov 10, 2021

ghost mentioned this pull request Nov 10, 2021

Discussion about pywhat output order and usability of given matches #232

Open

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add new RegEx for facebook tokens#225

Add new RegEx for facebook tokens#225
4 commits merged intobee-san:mainfrom
nodtem66:main

nodtem66 commented Nov 1, 2021

Uh oh!

bee-san commented Nov 2, 2021

Uh oh!

ghost left a comment

Uh oh!

nodtem66 commented Nov 3, 2021 •

edited

Loading

Uh oh!

ghost commented Nov 3, 2021

Uh oh!

nodtem66 commented Nov 3, 2021

Uh oh!

codecov-commenter commented Nov 7, 2021 •

edited

Loading

Uh oh!

ghost commented Nov 10, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

nodtem66 commented Nov 1, 2021

Prerequisites

Why do we need this pull request?

What GitHub issues does this fix?

Copy / paste of output

Uh oh!

bee-san commented Nov 2, 2021

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

nodtem66 commented Nov 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost commented Nov 3, 2021

Uh oh!

nodtem66 commented Nov 3, 2021

Uh oh!

codecov-commenter commented Nov 7, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ghost commented Nov 10, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nodtem66 commented Nov 3, 2021 •

edited

Loading

codecov-commenter commented Nov 7, 2021 •

edited

Loading