forked from mirrors/kingfisher
0f953f59a5
Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean.
55 lines
No EOL
1.7 KiB
YAML
55 lines
No EOL
1.7 KiB
YAML
rules:
|
|
- name: ThingsBoard Access Token
|
|
id: kingfisher.thingsboard.1
|
|
pattern: |
|
|
(?x)
|
|
\b
|
|
thingsboard\.cloud/api/v1/
|
|
(
|
|
[a-z0-9]{20}
|
|
)
|
|
\b
|
|
pattern_requirements:
|
|
min_digits: 2
|
|
confidence: medium
|
|
min_entropy: 3.0
|
|
examples:
|
|
- http://thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
|
|
- https://thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
|
|
- coap://coap.thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
|
|
references:
|
|
- https://thingsboard.io/docs/paas/reference/http-api/
|
|
- https://thingsboard.io/docs/paas/reference/coap-api/
|
|
|
|
- name: ThingsBoard Provision Device Key
|
|
id: kingfisher.thingsboard.2
|
|
pattern: |
|
|
(?x)
|
|
"provisionDeviceKey"\s*:\s*"
|
|
(
|
|
[a-z0-9]{20}
|
|
)
|
|
\b
|
|
confidence: medium
|
|
min_entropy: 3.0
|
|
examples:
|
|
- '"{"deviceName": "DEVICE_NAME", "provisionDeviceKey": "s2s1gfcuatgbi61n8h5s", "provisionDeviceSecret": "xbzsovaw9ix4qfhi14an"}"'
|
|
references:
|
|
- https://thingsboard.io/docs/paas/reference/http-api/
|
|
- https://thingsboard.io/docs/paas/user-guide/device-provisioning/
|
|
- name: ThingsBoard Provision Device Secret
|
|
id: kingfisher.thingsboard.3
|
|
pattern: |
|
|
(?x)
|
|
"provisionDeviceSecret"\s*:\s*"
|
|
(
|
|
[a-z0-9]{20}
|
|
)
|
|
\b
|
|
confidence: medium
|
|
min_entropy: 3.0
|
|
examples:
|
|
- '"{"deviceName": "DEVICE_NAME", "provisionDeviceKey": "s2s1gfcuatgbi61n8h5s", "provisionDeviceSecret": "xbzsovaw9ix4qfhi14an"}"'
|
|
references:
|
|
- https://thingsboard.io/docs/paas/reference/http-api/
|
|
- https://thingsboard.io/docs/paas/user-guide/device-provisioning/ |