eblume/kingfisher
1
0
Fork 0
forked from mirrors/kingfisher
Code Pull requests Activity Actions
kingfisher/data/rules/thingsboard.yml

55 lines
1.7 KiB
YAML
Raw Normal View History

added more rules
2025-08-16 20:23:27 -07:00
rules:
- name: ThingsBoard Access Token
id: kingfisher.thingsboard.1
pattern: |
(?x)
pattern_requirements for rules — Post-regex character-class gating to cut false positives without lookarounds. Authors can now require minimum counts of digits, uppercase, lowercase, and special characters, with an optional custom special-char set. Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean.
2025-11-04 13:55:31 -05:00
\b
added more rules
2025-08-16 20:23:27 -07:00
thingsboard\.cloud/api/v1/
pattern_requirements for rules — Post-regex character-class gating to cut false positives without lookarounds. Authors can now require minimum counts of digits, uppercase, lowercase, and special characters, with an optional custom special-char set. Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean.
2025-11-04 13:55:31 -05:00
(
[a-z0-9]{20}
)
\b
pattern_requirements:
min_digits: 2
added more rules
2025-08-16 20:23:27 -07:00
confidence: medium
min_entropy: 3.0
examples:
- http://thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
- https://thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
- coap://coap.thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
references:
- https://thingsboard.io/docs/paas/reference/http-api/
- https://thingsboard.io/docs/paas/reference/coap-api/
- name: ThingsBoard Provision Device Key
id: kingfisher.thingsboard.2
pattern: |
(?x)
"provisionDeviceKey"\s*:\s*"
pattern_requirements for rules — Post-regex character-class gating to cut false positives without lookarounds. Authors can now require minimum counts of digits, uppercase, lowercase, and special characters, with an optional custom special-char set. Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean.
2025-11-04 13:55:31 -05:00
(
[a-z0-9]{20}
)
\b
added more rules
2025-08-16 20:23:27 -07:00
confidence: medium
min_entropy: 3.0
examples:
- '"{"deviceName": "DEVICE_NAME", "provisionDeviceKey": "s2s1gfcuatgbi61n8h5s", "provisionDeviceSecret": "xbzsovaw9ix4qfhi14an"}"'
references:
- https://thingsboard.io/docs/paas/reference/http-api/
- https://thingsboard.io/docs/paas/user-guide/device-provisioning/
- name: ThingsBoard Provision Device Secret
id: kingfisher.thingsboard.3
pattern: |
(?x)
"provisionDeviceSecret"\s*:\s*"
pattern_requirements for rules — Post-regex character-class gating to cut false positives without lookarounds. Authors can now require minimum counts of digits, uppercase, lowercase, and special characters, with an optional custom special-char set. Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean.
2025-11-04 13:55:31 -05:00
(
[a-z0-9]{20}
)
\b
added more rules
2025-08-16 20:23:27 -07:00
confidence: medium
min_entropy: 3.0
examples:
- '"{"deviceName": "DEVICE_NAME", "provisionDeviceKey": "s2s1gfcuatgbi61n8h5s", "provisionDeviceSecret": "xbzsovaw9ix4qfhi14an"}"'
references:
- https://thingsboard.io/docs/paas/reference/http-api/
- https://thingsboard.io/docs/paas/user-guide/device-provisioning/
Copy permalink