diff --git a/patterns/gitleaks/8.27.0/99-testing.toml b/patterns/gitleaks/8.27.0/99-testing.toml index c4c77441..709d2de8 100644 --- a/patterns/gitleaks/8.27.0/99-testing.toml +++ b/patterns/gitleaks/8.27.0/99-testing.toml @@ -63,6 +63,16 @@ 'uyxv0adauy29tlyis', ] +[[rules]] + id = '9eKXOSk_IL5' + description = 'AWS API Gateway pattern' + regex = '''[0-9a-z]+.execute-api.[0-9a-z.-_]+.amazonaws.com''' + tags = ['type:secret', 'group:leaktk-testing'] + keywords = [ + 'amazonaws', + 'execute-api' + ] + [[rules]] id = 'qUN8svLm9sk' description = 'Dropbox Refresh Token' @@ -90,6 +100,25 @@ 'sl.', ] +[[rules]] + id = 'dX1904tMEXk' + description = 'Docker Swarm Token' + regex = '''SWMTKN-1-[a-z0-9]{50}-[a-z0-9]{25}''' + tags = ['type:secret', 'group:leaktk-testing'] + keywords = [ + 'SWMTKN' + ] + +[[rules]] + id = 'SgR9ek_sCbS' + description = 'Firefox Login Cookies File" + regex = '''Firefox\/Profiles\/.*\/cookies\.sqlite''' + tags = ['type:secret', 'group:leaktk-testing'] + keywords = [ + 'Firefox', + 'cookies', + ] + # This rule WAY WAY overmatches at the moment and can cause the scanner to # time out on large json files. # @@ -119,6 +148,25 @@ # '"universe_domain"', # ] +[[rules]] + id = '9lFJvq24U9i' + description = 'Google Cloud Platform OAuth' + regex = '''[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com''' + tags = ['type:secret', 'group:leaktk-testing'] + keywords = [ + 'apps', + 'googleusercontent', + ] + +[[rules]] + id = '24HsNTZRb7o' + description = 'Google OAuth Access Token' + regex = '''ya29\.[0-9A-Za-z\-_]+''' + ['type:secret', 'group:leaktk-testing'] + keywords = [ + 'ya29' + ] + [[rules]] id = 'JH9jBKr63QI' description = 'Label Studio API Key' @@ -128,6 +176,25 @@ 'label_studio_api_key', ] +#Smartsheets and Sonar patterns result in a lot of FPs, need further tuning +[[rules]] + id = 'GoeSKUlQf0Q' + description = 'Smartsheets Token" + regex = '''smartsheets.{0,40}\b([a-zA-Z0-9]{37})\b''' + tags = ['type:secret', 'group:leaktk-testing'] + keywords = [ + 'smartsheets' + ] + +[[rules]] + id = 'o1MeiRAJuCr' + description = 'Sonar Token" + regex = '''sonar.{0,40}\b([a-zA-Z0-9]{37})\b''' + tags = ['type:secret', 'group:leaktk-testing'] + keywords = [ + 'sonar' + ] + [[rules]] id = 'X2X0u9K8QKY' description = 'SonarQube Token' diff --git a/patterns/gitleaks/8.27.0/include/common_stopwords b/patterns/gitleaks/8.27.0/include/common_stopwords index 423a79cc..b7a6199f 100644 --- a/patterns/gitleaks/8.27.0/include/common_stopwords +++ b/patterns/gitleaks/8.27.0/include/common_stopwords @@ -58,9 +58,10 @@ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', diff --git a/target/patterns/gitleaks/8.18.2 b/target/patterns/gitleaks/8.18.2 index 8f552c95..339456bf 100644 --- a/target/patterns/gitleaks/8.18.2 +++ b/target/patterns/gitleaks/8.18.2 @@ -126,9 +126,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -379,9 +380,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -533,9 +535,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -731,9 +734,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -1531,9 +1535,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -1638,9 +1643,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -1782,9 +1788,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2039,9 +2046,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2217,9 +2225,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2343,9 +2352,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2453,9 +2463,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2580,9 +2591,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', diff --git a/target/patterns/gitleaks/8.27.0 b/target/patterns/gitleaks/8.27.0 index 8f552c95..339456bf 100644 --- a/target/patterns/gitleaks/8.27.0 +++ b/target/patterns/gitleaks/8.27.0 @@ -126,9 +126,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -379,9 +380,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -533,9 +535,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -731,9 +734,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -1531,9 +1535,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -1638,9 +1643,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -1782,9 +1788,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2039,9 +2046,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2217,9 +2225,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2343,9 +2352,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2453,9 +2463,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place', @@ -2580,9 +2591,10 @@ stopwords = [ 'notreal', 'oauth-basic', 'opens', +'option', +'pass123', 'passp', 'passw', -'pass123', 'path', 'pbench', 'place',