From fd675a12c638d0206aa2eafe38e29b70dd241df3 Mon Sep 17 00:00:00 2001 From: hugo-syn Date: Fri, 19 Apr 2024 14:34:39 +0200 Subject: [PATCH 1/3] feat: add Alibaba OSS bucket detection --- pkg/scanner/secrets.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkg/scanner/secrets.go b/pkg/scanner/secrets.go index db2b000..b6b07c0 100644 --- a/pkg/scanner/secrets.go +++ b/pkg/scanner/secrets.go @@ -372,6 +372,13 @@ func GetSecretRegexes() []Secret { []string{}, "?", }, + { + "Alibaba OSS Bucket", + "Alibaba OSS Bucket", + `(?:[a-zA-Z0-9-\.\_]+\.oss-[a-zA-Z0-9-\.\_]+\.aliyuncs\.com|oss\:\/\/[a-zA-Z0-9-\.\_]+|oss-[a-zA-Z0-9-\.\_]+\.aliyuncs\.com/[a-zA-Z0-9-\.\_]+)`, + []string{}, + "?", + }, } return regexes From 1a16d14010301e0282734e7d1b4add06e6efe6dc Mon Sep 17 00:00:00 2001 From: hugo-syn Date: Fri, 19 Apr 2024 15:12:09 +0200 Subject: [PATCH 2/3] fix: add oss:// to S3 and reduce regexp length for CI --- pkg/scanner/secrets.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/scanner/secrets.go b/pkg/scanner/secrets.go index b6b07c0..13c0085 100644 --- a/pkg/scanner/secrets.go +++ b/pkg/scanner/secrets.go @@ -333,7 +333,8 @@ func GetSecretRegexes() []Secret { "S3 Bucket", `(?:[a-zA-Z0-9_-]+s3\.amazonaws\.com|[a-zA-Z0-9_.-]+amazonaws\.com|` + `[a-zA-Z0-9-\.\_]+\.s3\.amazonaws\.com|s3\:\/\/[a-zA-Z0-9-\.\_]+|` + - `s3\.amazonaws\.com/[a-zA-Z0-9-\.\_]+)`, + `s3\.amazonaws\.com/[a-zA-Z0-9-\.\_]+|` + + `oss\:\/\/[a-zA-Z0-9-\.\_]+)`, []string{}, "?", }, @@ -375,7 +376,8 @@ func GetSecretRegexes() []Secret { { "Alibaba OSS Bucket", "Alibaba OSS Bucket", - `(?:[a-zA-Z0-9-\.\_]+\.oss-[a-zA-Z0-9-\.\_]+\.aliyuncs\.com|oss\:\/\/[a-zA-Z0-9-\.\_]+|oss-[a-zA-Z0-9-\.\_]+\.aliyuncs\.com/[a-zA-Z0-9-\.\_]+)`, + `(?:[a-zA-Z0-9-\.\_]+\.oss-[a-zA-Z0-9-\.\_]+\.aliyuncs\.com|` + + `oss-[a-zA-Z0-9-\.\_]+\.aliyuncs\.com/[a-zA-Z0-9-\.\_]+)`, []string{}, "?", }, From 1532f5f3eee50b4048ce5e392bb3a532afc745aa Mon Sep 17 00:00:00 2001 From: hugo-syn Date: Fri, 19 Apr 2024 15:50:03 +0200 Subject: [PATCH 3/3] fix: fix ci errors --- cmd/cariddi/main.go | 11 ++++++----- pkg/crawler/colly.go | 10 +++++----- pkg/output/output.go | 19 ++++++++++--------- 3 files changed, 21 insertions(+), 19 deletions(-) diff --git a/cmd/cariddi/main.go b/cmd/cariddi/main.go index 384b232..fc4d9bc 100644 --- a/cmd/cariddi/main.go +++ b/cmd/cariddi/main.go @@ -27,6 +27,7 @@ along with this program. If not, see http://www.gnu.org/licenses/. package main import ( + "fmt" "os" fileUtils "github.com/edoardottt/cariddi/internal/file" @@ -178,7 +179,7 @@ func main() { // If needed print secrets. if !flags.JSON && !flags.Plain && len(finalSecret) != 0 { for _, elem := range finalSecret { - output.EncapsulateCustomGreen(elem.Secret.Name, elem.Match+" in "+elem.URL) + output.EncapsulateCustomGreen(elem.Secret.Name, fmt.Sprintf("%s in %s", elem.Match, elem.URL)) } } @@ -194,7 +195,7 @@ func main() { } } - output.EncapsulateCustomGreen(finalString, " in "+elem.URL) + output.EncapsulateCustomGreen(finalString, fmt.Sprintf(" in %s", elem.URL)) } } } @@ -202,21 +203,21 @@ func main() { // If needed print extensions. if !flags.JSON && !flags.Plain && len(finalExtensions) != 0 { for _, elem := range finalExtensions { - output.EncapsulateCustomGreen(elem.Filetype.Extension, elem.URL+" matched!") + output.EncapsulateCustomGreen(elem.Filetype.Extension, fmt.Sprintf("%s matched!", elem.URL)) } } // If needed print errors. if !flags.JSON && !flags.Plain && len(finalErrors) != 0 { for _, elem := range finalErrors { - output.EncapsulateCustomGreen(elem.Error.ErrorName, elem.Match+" in "+elem.URL) + output.EncapsulateCustomGreen(elem.Error.ErrorName, fmt.Sprintf("%s in %s", elem.Match, elem.URL)) } } // If needed print infos. if !flags.JSON && !flags.Plain && len(finalInfos) != 0 { for _, elem := range finalInfos { - output.EncapsulateCustomGreen(elem.Info.Name, elem.Match+" in "+elem.URL) + output.EncapsulateCustomGreen(elem.Info.Name, fmt.Sprintf("%s in %s", elem.Match, elem.URL)) } } } diff --git a/pkg/crawler/colly.go b/pkg/crawler/colly.go index 451b1f5..4585f36 100644 --- a/pkg/crawler/colly.go +++ b/pkg/crawler/colly.go @@ -62,7 +62,7 @@ func New(scan *Scan) *Results { // if there isn't a scheme use http. if !urlUtils.HasProtocol(scan.Target) { protocolTemp = "http" - targetTemp = urlUtils.GetHost(protocolTemp + "://" + scan.Target) + targetTemp = urlUtils.GetHost(fmt.Sprintf("%s://%s", protocolTemp, scan.Target)) } else { protocolTemp = urlUtils.GetProtocol(scan.Target) targetTemp = urlUtils.GetHost(scan.Target) @@ -70,7 +70,7 @@ func New(scan *Scan) *Results { if scan.Intensive { var err error - targetTemp, err = urlUtils.GetRootHost(protocolTemp + "://" + targetTemp) + targetTemp, err = urlUtils.GetRootHost(fmt.Sprintf("%s://%s", protocolTemp, targetTemp)) if err != nil { fmt.Println(err.Error()) @@ -205,7 +205,7 @@ func New(scan *Scan) *Results { }) // Start scraping on target - path, err := urlUtils.GetPath(protocolTemp + "://" + scan.Target) + path, err := urlUtils.GetPath(fmt.Sprintf("%s://%s", protocolTemp, scan.Target)) if err == nil { var ( addPath string @@ -217,7 +217,7 @@ func New(scan *Scan) *Results { } if path == "" || path == "/" { - absoluteURL = protocolTemp + "://" + scan.Target + addPath + "robots.txt" + absoluteURL = fmt.Sprintf("%s://%s%srobots.txt", protocolTemp, scan.Target, addPath) if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, &ignoreSlice)) { err = c.Visit(absoluteURL) if err != nil && scan.Debug && !errors.Is(err, colly.ErrAlreadyVisited) { @@ -235,7 +235,7 @@ func New(scan *Scan) *Results { } } - err = c.Visit(protocolTemp + "://" + scan.Target) + err = c.Visit(fmt.Sprintf("%s://%s", protocolTemp, scan.Target)) if err != nil && scan.Debug && !errors.Is(err, colly.ErrAlreadyVisited) { log.Println(err) } diff --git a/pkg/output/output.go b/pkg/output/output.go index 43fceee..ba1b12f 100644 --- a/pkg/output/output.go +++ b/pkg/output/output.go @@ -71,7 +71,7 @@ func TxtOutput(flags input.Input, finalResults []string, finalSecret []scanner.S if flags.Secrets { SecretFilename := fileUtils.CreateOutputFile(flags.TXTout, "secrets", "txt") for _, elem := range finalSecret { - AppendOutputToTxt(elem.Secret.Name+" - "+elem.Match+" in "+elem.URL, SecretFilename) + AppendOutputToTxt(fmt.Sprintf("%s - %s in %s", elem.Secret.Name, elem.Match, elem.URL), SecretFilename) } } @@ -89,7 +89,7 @@ func TxtOutput(flags input.Input, finalResults []string, finalSecret []scanner.S } } - AppendOutputToTxt(finalString+" in "+elem.URL, EndpointFilename) + AppendOutputToTxt(fmt.Sprintf("%s in %s", finalString, elem.URL), EndpointFilename) } } } @@ -98,7 +98,7 @@ func TxtOutput(flags input.Input, finalResults []string, finalSecret []scanner.S if 1 <= flags.Extensions && flags.Extensions <= 7 { ExtensionsFilename := fileUtils.CreateOutputFile(flags.TXTout, "extensions", "txt") for _, elem := range finalExtensions { - AppendOutputToTxt(elem.Filetype.Extension+" in "+elem.URL, ExtensionsFilename) + AppendOutputToTxt(fmt.Sprintf("%s in %s", elem.Filetype.Extension, elem.URL), ExtensionsFilename) } } @@ -106,7 +106,7 @@ func TxtOutput(flags input.Input, finalResults []string, finalSecret []scanner.S if flags.Errors { ErrorsFilename := fileUtils.CreateOutputFile(flags.TXTout, "errors", "txt") for _, elem := range finalErrors { - AppendOutputToTxt(elem.Error.ErrorName+" - "+elem.Match+" in "+elem.URL, ErrorsFilename) + AppendOutputToTxt(fmt.Sprintf("%s - %s in %s", elem.Error.ErrorName, elem.Match, elem.URL), ErrorsFilename) } } @@ -114,7 +114,7 @@ func TxtOutput(flags input.Input, finalResults []string, finalSecret []scanner.S if flags.Info { InfosFilename := fileUtils.CreateOutputFile(flags.TXTout, "info", "txt") for _, elem := range finalInfos { - AppendOutputToTxt(elem.Info.Name+" - "+elem.Match+" in "+elem.URL, InfosFilename) + AppendOutputToTxt(fmt.Sprintf("%s - %s in %s", elem.Info.Name, elem.Match, elem.URL), InfosFilename) } } } @@ -148,7 +148,7 @@ func HTMLOutput(flags input.Input, resultFilename string, finalResults []string, HeaderHTML("Secrets found", resultFilename) for _, elem := range finalSecret { - AppendOutputToHTML(elem.Secret.Name+" - "+elem.Match+" in "+elem.URL, "", resultFilename, false) + AppendOutputToHTML(fmt.Sprintf("%s - %s in %s", elem.Secret.Name, elem.Match, elem.URL), "", resultFilename, false) } FooterHTML(resultFilename) @@ -168,7 +168,7 @@ func HTMLOutput(flags input.Input, resultFilename string, finalResults []string, } } - AppendOutputToHTML(finalString+" in "+elem.URL, "", resultFilename, false) + AppendOutputToHTML(fmt.Sprintf("%s in %s", finalString, elem.URL), "", resultFilename, false) } } @@ -180,7 +180,7 @@ func HTMLOutput(flags input.Input, resultFilename string, finalResults []string, HeaderHTML("Extensions found", resultFilename) for _, elem := range finalExtensions { - AppendOutputToHTML(elem.Filetype.Extension+" in "+elem.URL, "", resultFilename, false) + AppendOutputToHTML(fmt.Sprintf("%s in %s", elem.Filetype.Extension, elem.URL), "", resultFilename, false) } FooterHTML(resultFilename) @@ -191,7 +191,8 @@ func HTMLOutput(flags input.Input, resultFilename string, finalResults []string, HeaderHTML("Errors found", resultFilename) for _, elem := range finalErrors { - AppendOutputToHTML(elem.Error.ErrorName+" - "+elem.Match+" in "+elem.URL, "", resultFilename, false) + output := fmt.Sprintf("%s - %s in %s", elem.Error.ErrorName, elem.Match, elem.URL) + AppendOutputToHTML(output, "", resultFilename, false) } FooterHTML(resultFilename)