forked from mirrors/kingfisher
84 lines
No EOL
2.8 KiB
YAML
84 lines
No EOL
2.8 KiB
YAML
rules:
|
|
- name: Alibaba Access Key ID
|
|
id: kingfisher.alibabacloud.1
|
|
pattern: |
|
|
(?x)
|
|
(
|
|
LTAI([a-zA-Z0-9]{12,20})
|
|
)
|
|
\b
|
|
pattern_requirements:
|
|
min_digits: 2
|
|
min_uppercase: 1
|
|
min_lowercase: 1
|
|
min_entropy: 4.0
|
|
confidence: medium
|
|
visible: false
|
|
examples:
|
|
- LTAI8x2NiGqfyJGx7eLDhp12
|
|
- LTAI5GqyJGhp12ad31L5hpix
|
|
references:
|
|
- https://www.alibabacloud.com/help/en/ram/latest/create-an-accesskey-pair
|
|
- https://www.alibabacloud.com/help/en/openapi/using-openapi/signature-method-v1
|
|
- name: Alibaba Access Key Secret
|
|
id: kingfisher.alibabacloud.2
|
|
pattern: |
|
|
(?x)
|
|
\b
|
|
(?i:alibaba|alibaba[\s_-]*cloud|aliyun)
|
|
(?:.|[\n\r]){0,40}?
|
|
(?i:access[\s_-]*key[\s_-]*secret|access[\s_-]*secret|secret|token|key)
|
|
(?:.|[\n\r]){0,16}?
|
|
(?:
|
|
[=:]
|
|
|
|
|
["']\s*:\s*["']
|
|
)
|
|
\s*
|
|
["']?
|
|
(
|
|
[A-Za-z0-9]{30}
|
|
)
|
|
\b
|
|
["']?
|
|
min_entropy: 4.2
|
|
confidence: medium
|
|
examples:
|
|
- alibaba_secret = 7jkWdTjKLnSlGddwPR5gBn65PHcZG6
|
|
- alibaba-token = aJHKLnSlGddwPR5g7jkWdTBn65PHc5
|
|
validation:
|
|
type: Http
|
|
content:
|
|
request:
|
|
method: GET
|
|
url: >
|
|
{%- assign nonce = "" | uuid | upcase -%}
|
|
{%- assign raw_timestamp = "" | iso_timestamp_no_frac -%}
|
|
{%- assign timestamp = raw_timestamp | replace: ":", "%3A" -%}
|
|
|
|
{%- capture params -%}
|
|
AccessKeyId={{ AKID | url_encode }}&Action=GetCallerIdentity&Format=JSON&SignatureMethod=HMAC-SHA1&SignatureNonce={{ nonce }}&SignatureVersion=1.0&Timestamp={{ timestamp }}&Version=2015-04-01
|
|
{%- endcapture -%}
|
|
{%- assign encoded_params = params | replace: "+", "%20" | replace: "*", "%2A" | replace: "%7E", "~" -%}
|
|
{%- assign query_string = encoded_params | url_encode | replace: "%2D", "-" | replace: "%2E", "." -%}
|
|
|
|
{%- assign signature_base_string = "GET&%2F&" | append: query_string -%}
|
|
{%- assign token_amp = TOKEN | append: "&" -%}
|
|
|
|
{%- assign hmacsignature = signature_base_string | hmac_sha1: token_amp | url_encode -%}
|
|
|
|
https://sts.aliyuncs.com/?{{ params }}&Signature={{ hmacsignature }}
|
|
headers:
|
|
Accept: application/json
|
|
response_matcher:
|
|
- report_response: true
|
|
- type: StatusMatch
|
|
status: [200]
|
|
- type: WordMatch
|
|
words: ['"Arn"']
|
|
references:
|
|
- https://www.alibabacloud.com/help/en/openapi/using-openapi/signature-method-v1
|
|
- https://www.alibabacloud.com/help/en/ram/latest/create-an-accesskey-pair
|
|
depends_on_rule:
|
|
- rule_id: kingfisher.alibabacloud.1
|
|
variable: AKID |