[Feat] Detector implementation for Azure API Management Direct Management Key #3938

abmussani · 2025-02-26T15:54:23Z

Description:

This PR implements a new Detector for Azure Direct management API key. This detector looks for direct manage url and keys (Primary or Secondary), generates a access token with expiry of 5 seconds (to avoid leakage) and verify the credentials based on generated values.

Test Output:

$ go test -tags=detectors ./pkg/detectors/azuredirectmanagementkey/
ok  	github.com/trufflesecurity/trufflehog/v3/pkg/detectors/azuredirectmanagementkey	6.881s

Checklist:

Tests passing (make test-community)?
Lint passing (make lint this requires golangci-lint)?

rgmz · 2025-02-26T16:57:48Z

pkg/detectors/azuredirectmanagementkey/azuredirectmanagementkey.go

+			s1 := detectors.Result{
+				DetectorType: detectorspb.DetectorType_AzureDirectManagementKey,
+				Raw:          []byte(baseUrl),
+				RawV2:        []byte(baseUrl + primaryKey),


Can we start making RawV2 structured in new detectors? #3634 (comment)

@rgmz I am also not in favor of using RawV2 as structured secret. As @ahrav mentioned that it is tightly coupled with Enterprise and (in future) if we need to restructure it, due to any reason, We wont be able to do it.

My suggestion is to have another Map for this purpose.

... it is tightly coupled with Enterprise and (in future) if we need to restructure it, due to any reason, We wont be able to do it.

That is the case regardless. Making it structured at least makes it parseable and human-readable, unlike doing a simple concatenation.

rgmz · 2025-02-26T16:58:04Z

pkg/detectors/azuredirectmanagementkey/azuredirectmanagementkey.go

+var (
+	defaultClient = common.SaneHttpClient()
+	urlPat        = regexp.MustCompile(`https://([a-z0-9][a-z0-9-]{0,48}[a-z0-9])\.management\.azure-api\.net`)         // https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.APIM.Name/
+	primaryKeyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"azure"}) + `\b([a-zA-Z0-9+\/-]{86,88}\b={0,2})`) // Base64-encoded primary key


Why - at the end?

@rgmz Initially I copied that regex from another detector, Azure Storage. After your comment, I generated 20 times a key and confidently say that all of them ended with [a-zA-Z0-9]==. Updated the regex.

rgmz · 2025-02-28T14:46:57Z

pkg/detectors/azuredirectmanagementkey/azuredirectmanagementkey.go

+var (
+	defaultClient = common.SaneHttpClient()
+	urlPat        = regexp.MustCompile(`https://([a-z0-9][a-z0-9-]{0,48}[a-z0-9])\.management\.azure-api\.net`)                                          // https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.APIM.Name/
+	keyPat        = regexp.MustCompile(detectors.PrefixRegex([]string{"azure", ".management.azure-api.net"}) + `\b([a-zA-Z0-9+\/]{83,85}[a-zA-Z0-9]==)`) // pattern for both Primary and secondary key


\b isn't valid when beside / or +.

This has bitten me so many times... 😭

Updated the regex but AzureContainerRegistry Detector has the similar issue. right ?

code refactoring, remove unnecessary code. updated the description of detector. reduce the expiry to 5 seconds.

refactor variable name for better understanding.

implemented host caching if host is not reachable to avoid unnecessary extra verification calls.

kashifkhan0771

Just one comment related to False Positive Implementation. Rest LGTM!

kashifkhan0771 · 2025-04-21T14:16:41Z

pkg/detectors/azuredirectmanagementkey/azuredirectmanagementkey.go

+	return "Azure API Management provides a direct management REST API for performing operations on selected entities, such as users, groups, products, and subscriptions."
+}
+
+func (s Scanner) IsFalsePositive(_ detectors.Result) (bool, string) {


If we want to skip some specific keyword can we implement it as this

zricethezav · 2025-05-05T16:13:24Z

@abmussani gotta fix conflicts here too

* main: (40 commits) [Feat] Detector implementation for Azure API Management Direct Management Key (trufflesecurity#3938) Fastly Analyzer (trufflesecurity#4082) Postman Code Uses Consistent Casing for Id Var Names (trufflesecurity#4124) Normalize UID to Uid in Postman Code (trufflesecurity#4125) postman_client.IDNameUUID becomes IdNameUid (trufflesecurity#4123) Fixed Kontent Detector (trufflesecurity#4122) [Fix] Added Prefix In Dockerhub Detector Regex (trufflesecurity#4084) Issue - 3697 - GitHub analyzer panic (trufflesecurity#4113) fix(test/snowflake): Snowflake flaky pattern test (trufflesecurity#4083) Netlify Analyzer (trufflesecurity#4106) Add xAI detector (trufflesecurity#4117) added tunnel authtoken detection in ngrok detector (trufflesecurity#4115) Postman increase http client timeout (trufflesecurity#4086) feat: bing subscription key support (trufflesecurity#4092) Improve precommit hook setup and support both global and repo pre-commit hooks, frameworkless and with pre-commit or husky (trufflesecurity#4098) Make a first pass at some structural introduction docs (trufflesecurity#4076) Update action.yml (trufflesecurity#4108) Refactor Netlify Detector (trufflesecurity#4102) chore: added github action custom detector name (trufflesecurity#3417) Fixed PubnubsubsciptionKey detector verification (trufflesecurity#4107) ... # Conflicts: # pkg/engine/defaults/defaults.go # pkg/pb/detectorspb/detectors.pb.go # proto/detectors.proto

* main: [Feat] Added Mux API Analyzer (trufflesecurity#4128) fixed name of netlify analyzer in cli output (trufflesecurity#4140) fix(discordwebhook): Update Discord webhook detector to support 19-digit IDs (trufflesecurity#4133) [Feat] Added New AccuWeather Detector Version (trufflesecurity#4114) [Feat] Added Ngrok API Key Analyzer (trufflesecurity#4110) Improved JDBC Detector Regex (trufflesecurity#4109) [Feat] Detector implementation for Azure Configuration Connection String Key (trufflesecurity#3939) test(sources/s3): fix missing region error (trufflesecurity#4131) feat(sources/s3): migrate to AWS SDK v2 (trufflesecurity#4069) Update PreCommit.md (trufflesecurity#4112) Exclusion of FalsePositive GH's usernames in PrivateKeyDetector (trufflesecurity#4046) Monday App Analyzer (trufflesecurity#4120) [Feat] Detector implementation for Azure API Management Direct Management Key (trufflesecurity#3938) Fastly Analyzer (trufflesecurity#4082) Postman Code Uses Consistent Casing for Id Var Names (trufflesecurity#4124) Normalize UID to Uid in Postman Code (trufflesecurity#4125) postman_client.IDNameUUID becomes IdNameUid (trufflesecurity#4123) Fixed Kontent Detector (trufflesecurity#4122) # Conflicts: # pkg/analyzer/analyzers/analyzers.go # pkg/analyzer/cli.go

abmussani requested review from a team as code owners February 26, 2025 15:54

rgmz reviewed Feb 26, 2025

View reviewed changes

abmussani force-pushed the azuredirectmanagementapikey-detector-impl branch from eb37f00 to a76aa3d Compare February 28, 2025 10:52

rgmz mentioned this pull request Feb 28, 2025

Added azure COSMOSDB detector #3951

Merged

2 tasks

rgmz reviewed Feb 28, 2025

View reviewed changes

abmussani changed the title ~~[Feature] Detector implementation for Azure API Management Direct Management Key~~ [Feat] Detector implementation for Azure API Management Direct Management Key Mar 5, 2025

abmussani force-pushed the azuredirectmanagementapikey-detector-impl branch from b132a61 to 0a16736 Compare April 9, 2025 10:39

abmussani added 11 commits April 21, 2025 15:53

azuredirectmanagementapikey detector implementation and tests

7fb7492

add reference url

f7a81e6

use sanehttpclient

18d69f3

better regex

71e2475

add prefix regex for key pattern

0e168ab

some refactoring

55c0841

cleanup some unnecessary logic for expiry formatting.

9d54a00

code refactoring, remove unnecessary code. updated the description of detector. reduce the expiry to 5 seconds.

improvise the regex to increase confidence level.

77bc08c

refactor variable name for better understanding.

remove \b from regex

bb716ac

implemented CustomFalsePositiveChecker interface.

7e81600

implemented host caching if host is not reachable to avoid unnecessary extra verification calls.

add delimiter to raw v2

9345878

abmussani force-pushed the azuredirectmanagementapikey-detector-impl branch from ca0e501 to 9345878 Compare April 21, 2025 10:53

kashifkhan0771 approved these changes Apr 21, 2025

View reviewed changes

zricethezav approved these changes May 5, 2025

View reviewed changes

abmussani added 4 commits May 6, 2025 17:27

Merge branch 'main' into azuredirectmanagementapikey-detector-impl

6a29656

make protos

7c11936

Merge branch 'main' into azuredirectmanagementapikey-detector-impl

83d45a2

Merge branch 'main' into azuredirectmanagementapikey-detector-impl

9406c90

abmussani merged commit 18c009f into trufflesecurity:main May 8, 2025
13 checks passed

blsaccess mentioned this pull request May 9, 2025

Update trufflehog to 3.88.31 blacklanternsecurity/bbot#2385

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Feat] Detector implementation for Azure API Management Direct Management Key #3938

[Feat] Detector implementation for Azure API Management Direct Management Key #3938

Uh oh!

abmussani commented Feb 26, 2025

Uh oh!

rgmz Feb 26, 2025

Uh oh!

abmussani Mar 6, 2025

Uh oh!

rgmz Mar 6, 2025

Uh oh!

rgmz Feb 26, 2025

Uh oh!

abmussani Feb 28, 2025

Uh oh!

rgmz Feb 28, 2025

Uh oh!

ahrav Mar 2, 2025

Uh oh!

abmussani Mar 3, 2025

Uh oh!

kashifkhan0771 left a comment

Uh oh!

kashifkhan0771 Apr 21, 2025

Uh oh!

zricethezav commented May 5, 2025

Uh oh!

Uh oh!

Uh oh!

[Feat] Detector implementation for Azure API Management Direct Management Key #3938

[Feat] Detector implementation for Azure API Management Direct Management Key #3938

Uh oh!

Conversation

abmussani commented Feb 26, 2025

Description:

Checklist:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kashifkhan0771 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zricethezav commented May 5, 2025

Uh oh!

Uh oh!

Uh oh!