Regex for more crypto wallets, IPv6 and improved coordinates #26

amadejpapez · 2021-05-21T22:50:52Z

pyWhat can now detect Ripple, Bitcoin Cash, Litecoin and Monero!
added detection for IPv6
if there is a port number alongside of the IP address, it will now grab that too
improved detection for coordinates, added formats (N 32° 53.733 W 096° 48.358") and made it less restrictive (20,80 is no longer a coordinate :D)

bee-san · 2021-05-21T22:52:37Z

pywhat/Data/regex.json

+    },
+    {
+       "Name": "Bitcoin Cash (BCH) Wallet Address",
+       "Regex": "^bitcoincash:[a-zA-Z0-9]{42}$",


This is much higher as it says bitcoincash at the front, i'd give it a rarity of 1.0

bee-san · 2021-05-21T22:53:05Z

pywhat/Data/regex.json

@@ -251,15 +291,25 @@
       ]
    },
    {
-       "Name": "Internet Protocol (IP) Address",
-       "Regex": "(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)",
+       "Name": "Internet Protocol (IP) Address version 4",


Capitalise Version here :-)

bee-san · 2021-05-21T22:53:25Z

pywhat/Data/regex.json

       "Description": "Universal address pointing to an entity on the web.",
       "Rarity": 0.4,
       "Tags": [
          "Identifiers",
          "Networking"
       ]
    },
+    {
+       "Name": "Internet Protocol (IP) Address version 6",


Capitalise version here!

bee-san · 2021-05-21T22:54:08Z

pywhat/Data/regex.json

+       "Name": "Internet Protocol (IP) Address version 6",
+       "Regex": "\\[?(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\\]?(:[0-9]{1,5})?",
+       "Description": "Universal address pointing to an entity on the web.",
+       "Rarity": 1.0,


Please manually sort them in the file, so the ones with the highest rarity (1.0) go at the top and the lower the rarity the lower down in the file they are.

this is so when we import via JSON it's already sorted most likely (least false positives) to least likely (most false positives) :D

pywhat/printer.py

bee-san · 2021-05-21T22:55:59Z

tests/test_regex_identifier.py

+def test_monero():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["47DF8D9NwtmefhFUghynYRMqrexiZTsm48T1hhi2jZcbfcwoPbkhMrrED6zqJRfeYpXFfdaqAT3jnBEwoMwCx6BYDJ1W3ub"])
+    assert "Monero (XMR) Wallet Address" in res[0]["Regex Pattern"]["Name"]
+
+
+def test_litecoin():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["LRX8rSPVjifTxoLeoJtLf2JYdJFTQFcE7m"])
+    assert "Litecoin (LTC) Wallet Address" in res[0]["Regex Pattern"]["Name"]
+
+
+def test_bitcoincash():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["bitcoincash:qzlg6uvceehgzgtz6phmvy8gtdqyt6vf359at4n3lq"])
+    assert "Bitcoin Cash (BCH) Wallet Address" in res[0]["Regex Pattern"]["Name"]
+
+
+def test_ripple():
+    r = regex_identifier.RegexIdentifier()
+    res = r.check(["rBPAQmwMrt7FDDPNyjwFgwSqbWZPf6SLkk"])
+    assert "Ripple (XRP) Wallet Address" in res[0]["Regex Pattern"]["Name"]


This is annoying, but can you also add all the tests to:
https://github.com/bee-san/pyWhat/blob/main/fixtures/file

And copy / paste into:
https://github.com/bee-san/pyWhat/blob/main/tests/test_click.py

Because of how many regexes this has, we need to be on the ball with testing. We need to have a lot of tests to make sure we don't slip up :-)

bee-san · 2021-05-21T22:56:57Z

pywhat/printer.py

            "YouTube Video ID": "https://www.youtube.com/watch?v=",
            "YouTube Channel ID": "https://www.youtube.com/channel/",
            "Latitude & Longitude Coordinates": "https://www.google.com/maps/place/",


Can we include the Shodan link here for IP addresses, please?
https://www.shodan.io/search?query=6.6.6.6

for 6.6.6.6 :-)

Actually, the URL is this:

https://www.shodan.io/host/118.103.238.230

bee-san · 2021-05-21T22:57:55Z

pywhat/printer.py

+            "Ethereum (ETH) Wallet Address": "https://etherscan.io/address/",
+            "Dogecoin (DOGE) Wallet Address": "https://dogechain.info/address/",
+            "Bitcoin (BTC) Wallet Address": "https://www.blockchain.com/btc/address/",


Also this is annoying -- but can we test that these links show up? You can do so by:
This is annoying, but can you also add all the tests to:
https://github.com/bee-san/pyWhat/blob/main/fixtures/file

And copy / paste into:
https://github.com/bee-san/pyWhat/blob/main/tests/test_click.py

and then in that Click file trying to match the dogechain / etherscan URL etc :-) (I'd just do re.searchall("dogechain") to find it 😄

bee-san · 2021-05-21T22:59:18Z

pywhat/printer.py

            "YouTube Video ID": "https://www.youtube.com/watch?v=",
            "YouTube Channel ID": "https://www.youtube.com/channel/",
            "Latitude & Longitude Coordinates": "https://www.google.com/maps/place/",


Actually, the URL is this:

https://www.shodan.io/host/118.103.238.230

bee-san · 2021-05-21T23:02:54Z

pywhat/Data/regex.json

@@ -10,7 +10,7 @@
       ]
    },
    {
-       "Name": "Bitcoin Wallet",
+       "Name": "Bitcoin (BTC) Wallet Address",


Perhaps include the bitcoin char here? ₿

amadejpapez added 3 commits May 22, 2021 00:25

Regex for more crypto wallets, IPv6 and improved coordinates

3f0b3c2

Replaced ° with unicode character as cmd does not support that

a97ac25

Also replaced ° with unicode character in regex

f35b1b0

bee-san requested changes May 21, 2021

View reviewed changes

Merge branch 'main' into update-regex

0da853b

amadejpapez closed this May 23, 2021

amadejpapez deleted the update-regex branch May 23, 2021 12:55

amadejpapez mentioned this pull request May 23, 2021

Regex for LTC, BCH, XRP, XMR crypto wallets, IPv6 and more #36

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Regex for more crypto wallets, IPv6 and improved coordinates #26

Regex for more crypto wallets, IPv6 and improved coordinates #26

amadejpapez commented May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

bee-san May 21, 2021

Regex for more crypto wallets, IPv6 and improved coordinates #26

Regex for more crypto wallets, IPv6 and improved coordinates #26

Conversation

amadejpapez commented May 21, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment