scan.save

#!/usr/bin/env python3
import requests, re, json, base64, html, random, sys, time, copy, os, argparse
import jsbe

import httpsuite







regex_str = r"""
  (?:"|')                               # Start newline delimiter
  (
    ((?:[a-zA-Z]{1,10}://|//)           # Match a scheme [a-Z]*1-10 or //
    [^"'/]{1,}\.                        # Match a domainname (any character + dot)
    [a-zA-Z]{2,}[^"']{0,})              # The domainextension and/or path
    |
    ((?:/|\.\./|\./)                    # Start with /,../,./
    [^"'><,;| *()(%%$^/\\\[\]]          # Next character can't be...
    [^"'><,;|()]{1,})                   # Rest of the characters can't be
    |
    ([a-zA-Z0-9_\-/]{1,}/               # Relative endpoint with /
    [a-zA-Z0-9_\-/]{1,}                 # Resource name
    \.(?:[a-zA-Z]{1,4}|action)          # Rest + extension (length 1-4 or action)
    (?:[\?|#][^"|']{0,}|))              # ? or # mark with parameters
    |
    ([a-zA-Z0-9_\-/]{1,}/               # REST API (no extension) with /
    [a-zA-Z0-9_\-/]{3,}                 # Proper REST endpoints usually have 3+ chars
    (?:[\?|#][^"|']{0,}|))              # ? or # mark with parameters
    |
    ([a-zA-Z0-9_\-]{1,}                 # filename
    \.(?:php|asp|aspx|jsp|json|
         action|html|js|txt|xml)        # . + extension
    (?:[\?|#][^"|']{0,}|))              # ? or # mark with parameters
  )
  (?:"|')                               # End newline delimiter
"""



regex_secrets = {
        'facebook_access_token' : r'EAACEdEose0cBA[0-9A-Za-z]+',
    	'authorization_basic' : r'basic [a-zA-Z0-9=:_\+\/-]{5,100}',
    	'authorization_bearer' : r'bearer [a-zA-Z0-9_\-\.=:_\+\/]{5,100}',
    	'authorization_api' : r'api[key|_key|\s+]+[a-zA-Z0-9_\-]{5,100}',
		'json_web_token' : r'ey[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$',
        "base64":"(eyJ|YTo|Tzo|PD[89]|aHR0cHM6L|aHR0cDo|rO0)[a-zA-Z0-9+/]+={0,2}",
        "md5":"[a-f0-9]{32}",
        "ipv4":"\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}\b",
        "ipv6":"(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))",
    	"Cloudinary"  : "cloudinary://.*",
	    "Firebase URL": ".*firebaseio\.com",
	    "Slack Token": "(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
    	"RSA private key": "-----BEGIN RSA PRIVATE KEY-----",
    	"SSH (DSA) private key": "-----BEGIN DSA PRIVATE KEY-----",
    	"SSH (EC) private key": "-----BEGIN EC PRIVATE KEY-----",
    	"PGP private key block": "-----BEGIN PGP PRIVATE KEY BLOCK-----",
    	"Amazon AWS Access Key ID": "AKIA[0-9A-Z]{16}",
    	"Amazon MWS Auth Token": "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
    	"AWS API Key": "AKIA[0-9A-Z]{16}",
    	"Facebook Access Token": "EAACEdEose0cBA[0-9A-Za-z]+",
    	"Facebook OAuth": "[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K].*['|\"][0-9a-f]{32}['|\"]",
    	"GitHub": "[g|G][i|I][t|T][h|H][u|U][b|B].*['|\"][0-9a-zA-Z]{35,40}['|\"]",
    	"Generic API Key": "[a|A][p|P][i|I][_]?[k|K][e|E][y|Y].*['|\"][0-9a-zA-Z]{32,45}['|\"]",
    	"Generic Secret": "[s|S][e|E][c|C][r|R][e|E][t|T].*['|\"][0-9a-zA-Z]{32,45}['|\"]",
    	"Google API Key": "AIza[0-9A-Za-z\\-_]{35}",
    	"Google Cloud Platform API Key": "AIza[0-9A-Za-z\\-_]{35}",
    	"Google Cloud Platform OAuth": "[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com",
    	"Google Drive API Key": "AIza[0-9A-Za-z\\-_]{35}",
    	"Google Drive OAuth": "[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com",
    	"Google (GCP) Service-account": "\"type\": \"service_account\"",
    	"Google Gmail API Key": "AIza[0-9A-Za-z\\-_]{35}",
    	"Google Gmail OAuth": "[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com",
    	"Google OAuth Access Token": "ya29\\.[0-9A-Za-z\\-_]+",
    	"Google YouTube API Key": "AIza[0-9A-Za-z\\-_]{35}",
    	"Google YouTube OAuth": "[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com",
    	"Heroku API Key": "[h|H][e|E][r|R][o|O][k|K][u|U].*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}",
    	"MailChimp API Key": "[0-9a-f]{32}-us[0-9]{1,2}",
    	"Mailgun API Key": "key-[0-9a-zA-Z]{32}",
    	"Password in URL": "[a-zA-Z]{3,10}://[^/\\s:@]{3,20}:[^/\\s:@]{3,20}@.{1,100}[\"'\\s]",
    	"PayPal Braintree Access Token": "access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}",
    	"Picatic API Key": "sk_live_[0-9a-z]{32}",
    	"Slack Webhook": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
    	"Stripe API Key": "sk_live_[0-9a-zA-Z]{24}",
    	"Stripe Restricted API Key": "rk_live_[0-9a-zA-Z]{24}",
    	"Square Access Token": "sq0atp-[0-9A-Za-z\\-_]{22}",
    	"Square OAuth Secret": "sq0csp-[0-9A-Za-z\\-_]{43}",
    	"Twilio API Key": "SK[0-9a-fA-F]{32}",
    	"Twitter Access Token": "[t|T][w|W][i|I][t|T][t|T][e|E][r|R].*[1-9][0-9]+-[0-9a-zA-Z]{40}",
    	"Twitter OAuth": "[t|T][w|W][i|I][t|T][t|T][e|E][r|R].*['|\"][0-9a-zA-Z]{35,44}['|\"]"
}



def find_secrets(content, regex_dict=regex_secrets):
    matches = {}
    for key, regex in regex_dict.items():
        regex = re.compile(regex, re.VERBOSE)
        matches[key] = [match.group() for match in re.finditer(regex, content)]
    return matches

    
def get_urls(content):
    #Find urls on the file
    
    regex = re.compile(regex_str, re.VERBOSE)
    for m in re.finditer(regex, content):
        
        if m.group(1) not in links["full_urls"] and m.group(1) is not None:
            links["full_urls"].append(m.group(1))
        if m.group(2) not in links["path_trv"] and m.group(2) is not None:
            links["path_trv"].append(m.group(2))
        if m.group(3) not in links["endpoint"] and m.group(3) is not None:
            links["endpoint"].append(m.group(3))
        if m.group(4) not in links["relative_with_ext"] and m.group(4) is not None:
            links["relative_with_ext"].append(m.group(4))


        



parser = argparse.ArgumentParser(prog="Burp raffic analyzer")
parser.add_argument("filename")

args = parser.parse_args()

root = json.load(open(args.filename,"r"))

matches = {}
links = {
    "full_urls":[],
    "path_trv":[],
    "endpoint":[],
    "relative_with_ext":[]
}
if __name__ == '__main__':
   
    
    for conn in root:
        try:    
            path = conn["path"]
            request = base64.b64decode(conn["raw"]).decode("utf-8")
            
            response = base64.b64decode(conn["response"]["raw"]).decode("utf-8")
        except Exception as e:
            print("parser error. -->"+str(e))
            continue
            
        for extension in [".webp", ".png", ".jpg", ".jpeg", ".ico", ".svg"]:
            if extension in path:
                continue

        
        
        get_urls(request)
        for key, values in find_secrets(content=request).items():
            if key not in matches:
                matches[key] = values
            else:
                for value in values:
                    if value not in matches[key]:
                        matches[key].append(value)
        
        
        get_urls(response)
        for key, values in find_secrets(content=request).items():
            if key not in matches:
                matches[key] = values
            else:
                for value in values:
                    if value not in matches[key]:
                        matches[key].append(value)
                

        
        
        
        """
        try:
            request = httpsuite.Request.parse(request)
            get_urls(req_body)
        except Exception as e:
            print("Parsing request error.")
            
        
        try:         
            response = httpsuite.Response.parse(response)
            
            req_body = str(request.body)
            body = str(response.body)
            if "Content-Type" in response.headers:
                if response.headers["Content-Type"] == "text/javascript":
                    body = jsbeautifier.beautify(str(response.body))
            
            get_urls(body)
        except Exception as e:
            print("Parsing response error --> "+str(e))
        """
          
            
        
            
       
    with open("secrets.json", "w") as file:
        json.dump(matches, file, indent=3)

    with open("links.json", "w") as file:
        json.dump(links, file, indent=3)