-
-
Notifications
You must be signed in to change notification settings - Fork 348
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add TOTP URIs #190
Add TOTP URIs #190
Conversation
pywhat/Data/regex.json
Outdated
{ | ||
"Name": "TOTP URI", | ||
"Regex": "^([^?\\n]+:\/\/totp\/[^\\n]+secret=[A-Z2-7=]+[^\\n]+)$", | ||
"plural_name": false, | ||
"Description": "TOTP URI with user secret key", | ||
"Rarity": 1, | ||
"URL": "", | ||
"Tags": [ | ||
"Credentials", | ||
"TOTP" | ||
] | ||
}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
{ | |
"Name": "TOTP URI", | |
"Regex": "^([^?\\n]+:\/\/totp\/[^\\n]+secret=[A-Z2-7=]+[^\\n]+)$", | |
"plural_name": false, | |
"Description": "TOTP URI with user secret key", | |
"Rarity": 1, | |
"URL": "", | |
"Tags": [ | |
"Credentials", | |
"TOTP" | |
] | |
}, | |
{ | |
"Name": "Time-Based One-Time Password (TOTP) URI", | |
"Regex": "^([^?\\n]+:\/\/totp\/[^\\n]+secret=[A-Z2-7=]+[^\\n]+)$", | |
"plural_name": false, | |
"Description": null, | |
"Rarity": 1, | |
"URL": null, | |
"Tags": [ | |
"Credentials", | |
"TOTP", | |
"Bug Bounty" | |
] | |
}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How about this? :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why not ! Not sure about the bug bounty tag though. I guess it would be rather useful for a pentester, searching for vulnerabilities/credentials and not proper bugs.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Well, I'll leave the Bug Bounty tag. Looking at other entries in regex.json
I see it associated with similar topics like API keys.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not sure about the bug bounty tag though
If you have this URL, you can access someones 2FA right? That's definitely a vuln :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep, the secret
arg value is what you need to get the 2FA code. This kind of URI is what is inside QR Codes provided by all websites. And you can also find it inside backup files made by people using Authy, Google Authenticator, Bitwarden, etc.
tests/test_click.py
Outdated
def test_file_fixture_totp_URI(): | ||
runner = CliRunner() | ||
result = runner.invoke(main, ["fixtures/file"]) | ||
assert result.exit_code == 0 | ||
assert re.findall("TOTP URI", str(result.output)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nice test!
tests/test_regex_identifier.py
Outdated
res = r.check( | ||
[ | ||
"otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example" | ||
] | ||
) | ||
assert "TOTP URI" in str(res) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we assert it's the first item? We have a function for this at the top of this file :) _assert_match_first_item
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep, just tested it, it does work. I think I had a doubt with regular URL match but it indeed come as first item.
Woo! Thanks :) gonna merge! 🥳 |
Codecov Report
@@ Coverage Diff @@
## main #190 +/- ##
==========================================
+ Coverage 92.06% 92.11% +0.05%
==========================================
Files 13 13
Lines 1600 1611 +11
==========================================
+ Hits 1473 1484 +11
Misses 127 127
Continue to review full report at Codecov.
|
Ok, just pushed the above edits and added a more complex test, especially to test arguments position swapping inside the URI. |
This commit adds TOTP URIs regex and related tests.
You might find TOTP URIs in Google Authenticator, Authy, Bitwarden, etc. backups. Or just anywhere if you're doing Android/iOS pentesting. And with its base-32 key, TOTP is all yours !
I might add some other pentesting related regex in the next few days :)