Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: corrected verification endpoint & validation logic for bombbomb #3462

Merged
merged 15 commits into from
Dec 16, 2024
Merged

fix: corrected verification endpoint & validation logic for bombbomb #3462

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
ee7f670
fix: corrected verification endpoint for bombbomb
sahil9001 Oct 17, 2024
6f201a4
fix: corrected verification endpoint and validation logic for bombbomb
sahil9001 Oct 17, 2024
dbfc716
Remove debug binary file from tracking
sahil9001 Oct 17, 2024
5e8cd0e
Merge remote-tracking branch 'upstream/main' into bombbomb-verficatio…
sahil9001 Oct 17, 2024
6636657
Merge branch 'main' into bombbomb-verfication-endpoint-fix
kashifkhan0771 Oct 28, 2024
a66a2cb
feat: added common jwt pattern
sahil9001 Oct 28, 2024
c9af6f2
Merge remote-tracking branch 'upstream/main' into bombbomb-verficatio…
sahil9001 Oct 28, 2024
88ec64b
fix: fixed the regex to include common prefix
sahil9001 Oct 30, 2024
e28c8f3
Merge remote-tracking branch 'upstream/main' into bombbomb-verficatio…
sahil9001 Oct 30, 2024
22ebe52
fix: added common prefix to JWT Pattern
sahil9001 Oct 30, 2024
ea9f70e
Merge remote-tracking branch 'upstream/main' into bombbomb-verficatio…
sahil9001 Nov 9, 2024
71dc1df
chore: changed the regex to call the function `BuildRegex`
sahil9001 Nov 9, 2024
799f644
Merge branch 'main' into bombbomb-verfication-endpoint-fix
kashifkhan0771 Nov 12, 2024
f02562b
Merge branch 'main' into bombbomb-verfication-endpoint-fix
kashifkhan0771 Nov 14, 2024
81100ed
Merge branch 'main' into bombbomb-verfication-endpoint-fix
kashifkhan0771 Dec 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pkg/common/patterns.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
)

const EmailPattern = `\b(?:[a-z0-9!#$%&'*+/=?^_\x60{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_\x60{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])\b`
const JWTPattern = `\b[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\b`
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sahil9001 this is too loose. Take a look at this for a reference https://github.com/gitleaks/gitleaks/blob/43fae355e6fe4d99d2a7b240a224b85e2903aeb4/config/gitleaks.toml#L2311 or even

trufflehog/pkg/detectors/formio/formio.go

Line 23 in 6a367ab

keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"formio"}) + `\b(eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[0-9A-Za-z]{220,310}\.[0-9A-Z-a-z\-_]{43}[ \r\n]{1})`)
. The first section might be consistent across all bombomb tokens.

Copy link
Contributor Author

@sahil9001 sahil9001 Oct 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, it changes with each refresh, apparently there is a jti field which changes each time which eventually changes the first part each time as well.

Screenshot 2024-10-28 at 9 04 41 PM

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sahil9001 JWT are base64 encoded so that means there will be a common prefix for all JWT, base64('{"')=ey. Take a look at https://www.ibm.com/docs/en/cics-ts/6.x?topic=cics-json-web-token-jwt.

Copy link
Contributor Author

@sahil9001 sahil9001 Oct 30, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zricethezav , thanks, I read more about it, I found out that —

  1. The typ part is common for all JWT tokens.
  2. alg and jti changes due to which we can only constraint the JWT common prefix upto ey.

Please take a look, I have made the change.

const SubDomainPattern = `\b([A-Za-z0-9](?:[A-Za-z0-9\-]{0,61}[A-Za-z0-9])?)\b`
const UUIDPattern = `\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b`
const UUIDPatternUpperCase = `\b([0-9A-Z]{8}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{12})\b`
Expand Down
10 changes: 6 additions & 4 deletions pkg/detectors/bombbomb/bombbomb.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,11 @@ package bombbomb

import (
"context"
regexp "github.com/wasilibs/go-re2"
"net/http"
"strings"

regexp "github.com/wasilibs/go-re2"

"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
Expand All @@ -20,7 +21,7 @@ var (
client = common.SaneHttpClient()

// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bombbomb"}) + `\b([a-zA-Z0-9-._]{704})\b`)
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bombbomb"}) + common.JWTPattern)
)

// Keywords are used for efficiently pre-filtering chunks.
Expand All @@ -47,11 +48,12 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
}

if verify {
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.bombbomb.com/v2/lists/", nil)
// Reference : https://developer.bombbomb.com/api#operations-Users-UserInfo
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.bombbomb.com/v2/user/", nil)
if err != nil {
continue
}
req.Header.Add("Authorization", resMatch)
req.Header.Add("Authorization", "Bearer "+resMatch)
res, err := client.Do(req)
if err == nil {
defer res.Body.Close()
Expand Down
Loading