forked from mirrors/kingfisher
0f953f59a5
Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean.
37 lines
No EOL
1.2 KiB
YAML
37 lines
No EOL
1.2 KiB
YAML
rules:
|
|
- name: WireGuard Private Key
|
|
id: kingfisher.wireguard.1
|
|
pattern: PrivateKey\s*=\s*([A-Za-z0-9+/]{43}=)
|
|
pattern_requirements:
|
|
min_digits: 2
|
|
min_entropy: 3.3
|
|
confidence: medium
|
|
examples:
|
|
- |
|
|
[Interface]
|
|
Address = 10.200.200.3/32
|
|
PrivateKey = AsaFot43bfs1fEWjvtty+rGcjh3rP1H6sug1l3u19ix=
|
|
DNS = 8.8.8.8
|
|
references:
|
|
- https://www.wireguard.com/quickstart/
|
|
- https://manpages.debian.org/testing/wireguard-tools/wg.8.en.html
|
|
- https://gist.github.com/lanceliao/5d2977f417f34dda0e3d63ac7e217fd6
|
|
categories: [fuzzy, secret]
|
|
|
|
- name: WireGuard Preshared Key
|
|
id: kingfisher.wireguard.2
|
|
pattern: PresharedKey\s*=\s*([A-Za-z0-9+/]{43}=)
|
|
min_entropy: 3.3
|
|
confidence: medium
|
|
examples:
|
|
- |
|
|
[Peer]
|
|
PublicKey = [Server's public key]
|
|
PresharedKey = uRsfsZ2Ts1rach4Zv3hhwcx6wa5fuIo2u3w7sa+7j81=
|
|
AllowedIPs = 0.0.0.0/0, ::/0
|
|
Endpoint = [Server Addr:Server Port]
|
|
references:
|
|
- https://www.wireguard.com/quickstart/
|
|
- https://manpages.debian.org/testing/wireguard-tools/wg.8.en.html
|
|
- https://gist.github.com/lanceliao/5d2977f417f34dda0e3d63ac7e217fd6
|
|
categories: [fuzzy, secret] |