-
Notifications
You must be signed in to change notification settings - Fork 0
/
regex-keywords-ad-to-Burp-SensitiveDiscoverer.txt
120 lines (102 loc) · 6.4 KB
/
regex-keywords-ad-to-Burp-SensitiveDiscoverer.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
To create a regex pattern that looks for any database error condition in the source, you can use the following comprehensive pattern. This regex aims to capture common error messages from various databases:
regex
(?:SQL\s+syntax\s+error|Warning:\s+mysql_|MySQLSyntaxErrorException|com\.mysql\.jdbc\.exceptions|SQLException|MySQLNonTransientConnectionException|MySQLTransientConnectionException|MySQLDataTruncation|MySQLIntegrityConstraintViolationException|Table\s+'.*?'\s+doesn't\s+exist|You\s+have\s+an\s+error\s+in\s+your\s+SQL\s+syntax|org\.postgresql\.util\.PSQLException|PG::SyntaxError|PG::UndefinedTable|PG::ConnectionBad|syntax\s+error\s+at\s+or\s+near|could\s+not\s+connect\s+to\s+server|role\s+does\s+not\s+exist|relation\s+".*?"\s+does\s+not\s+exist|MongoDB\s+Error|MongoException|MongoConnectionException|MongoCursorTimeoutException|MongoCursorException|MongoDuplicateKeyException|MongoExecutionTimeoutException|MongoWriteConcernException|MongoWriteException|E11000\s+duplicate\s+key\s+error|Microsoft\s+ODBC\s+SQL\s+Server\s+Driver|SQLServerException|com\.microsoft\.sqlserver\.jdbc\.SQLServerException|Unclosed\s+quotation\s+mark\s+after\s+the\s+character\s+string|Incorrect\s+syntax\s+near|ORA-\d{4,5}|OracleException|oracle\.jdbc\.driver\.OracleDriver|SQLRecoverableException|oracle\.sql\.ROWID|PLS-\d{4,5}|SP2-\d{4,5}|TNS-\d{4,5}|SQLiteException|sqlite3\.OperationalError|sqlite3\.DatabaseError|sqlite3\.DataError|sqlite3\.IntegrityError|sqlite3\.ProgrammingError|sqlite3\.NotSupportedError|sqlite\.error|near\s+"[\w]+"|CouchDB\s+error|Cassandra\s+error|com\.datastax\.driver\.core\.exceptions|DocumentNotFoundException|com\.couchbase\.client\.java\.error|org\.apache\.cassandra\.exceptions|database\s+is\s+locked|unable\s+to\s+connect\s+to\s+database|unexpected\s+end\s+of\s+command|unterminated\s+string|column\s+does\s+not\s+exist|query\s+error|database\s+error|failed\s+to\s+execute\s+query)
Explanation
This pattern combines various fragments of error messages from different database systems. The (?: ... ) non-capturing group is used to group these fragments without capturing them, which keeps the matching efficient.
MySQL Errors:
regex
SQL\s+syntax\s+error|Warning:\s+mysql_|MySQLSyntaxErrorException|com\.mysql\.jdbc\.exceptions|SQLException|MySQLNonTransientConnectionException|MySQLTransientConnectionException|MySQLDataTruncation|MySQLIntegrityConstraintViolationException|Table\s+'.*?'\s+doesn't\s+exist|You\s+have\s+an\s+error\s+in\s+your\s+SQL\s+syntax
PostgreSQL Errors:
regex
org\.postgresql\.util\.PSQLException|PG::SyntaxError|PG::UndefinedTable|PG::ConnectionBad|syntax\s+error\s+at\s+or\s+near|could\s+not\s+connect\s+to\s+server|role\s+does\s+not\s+exist|relation\s+".*?"\s+does\s+not\s+exist
MongoDB Errors:
regex
MongoDB\s+Error|MongoException|MongoConnectionException|MongoCursorTimeoutException|MongoCursorException|MongoDuplicateKeyException|MongoExecutionTimeoutException|MongoWriteConcernException|MongoWriteException|E11000\s+duplicate\s+key\s+error
SQL Server Errors:
regex
Microsoft\s+ODBC\s+SQL\s+Server\s+Driver|SQLServerException|com\.microsoft\.sqlserver\.jdbc\.SQLServerException|Unclosed\s+quotation\s+mark\s+after\s+the\s+character\s+string|Incorrect\s+syntax\s+near
Oracle Errors:
regex
ORA-\d{4,5}|OracleException|oracle\.jdbc\.driver\.OracleDriver|SQLRecoverableException|oracle\.sql\.ROWID|PLS-\d{4,5}|SP2-\d{4,5}|TNS-\d{4,5}
SQLite Errors:
regex
SQLiteException|sqlite3\.OperationalError|sqlite3\.DatabaseError|sqlite3\.DataError|sqlite3\.IntegrityError|sqlite3\.ProgrammingError|sqlite3\.NotSupportedError|sqlite\.error|near\s+"[\w]+"
NoSQL (CouchDB, Cassandra, etc.) Errors:
regex
CouchDB\s+error|Cassandra\s+error|com\.datastax\.driver\.core\.exceptions|DocumentNotFoundException|com\.couchbase\.client\.java\.error|org\.apache\.cassandra\.exceptions
Generic Errors:
regex
database\s+is\s+locked|unable\s+to\s+connect\s+to\s+database|unexpected\s+end\s+of\s+command|unterminated\s+string|column\s+does\s+not\s+exist|query\s+error|database\s+error|failed\s+to\s+execute\s+query
^.*_rsa$
^.*_dsa$
^.*_ed25519$
^.*_ecdsa$
\.?ssh/config$
^key(pair)?$
^\.?(bash_|zsh_|sh_|z)?history$
^\.?mysql_history$
^\.?psql_history$
^\.?pgpass$
^\.?irb_history$
\.?purple/accounts\.xml$
\.?xchat2?/servlist_?\.conf$
\.?irssi/config$
\.?recon-ng/keys\.db$
^\.?dbeaver-data-sources.xml$
^\.?muttrc$
^\.?s3cfg$
\.?aws/credentials$
^sftp-config(\.json)?$
^\.?trc$
^\.?(bash|zsh|csh)rc$
^\.?(bash_|zsh_)?profile$
^\.?(bash_|zsh_)?aliases$
config(\.inc)?\.php$
^key(store|ring)$
^kdbx?$
^sql(dump)?$
^\.?htpasswd$
^(\.|_)?netrc$
\.?gem/credentials$
^\.?tugboat$
doctl/config.yaml$
^\.?git-credentials$
config/hub$
^\.?gitconfig$
\.?chef/(.*)\.pem$
etc/shadow$
etc/passwd$
^\.?dockercfg$
^\.?npmrc$
^\.?env$
(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
((\"|'|`)?((?i)aws)?_?((?i)access)_?((?i)key)?_?((?i)id)?(\"|'|`)?\s{0,50}(:|=>|=)\s{0,50}(\"|'|`)?(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}(\"|'|`)?)
((\"|'|`)?((?i)aws)?_?((?i)account)_?((?i)id)?(\"|'|`)?\s{0,50}(:|=>|=)\s{0,50}(\"|'|`)?[0-9]{4}-?[0-9]{4}-?[0-9]{4}(\"|'|`)?)
((\"|'|`)?((?i)aws)?_?((?i)secret)_?((?i)access)?_?((?i)key)?_?((?i)id)?(\"|'|`)?\s{0,50}(:|=>|=)\s{0,50}(\"|'|`)?[A-Za-z0-9/+=]{40}(\"|'|`)?)
((\"|'|`)?((?i)aws)?_?((?i)session)?_?((?i)token)?(\"|'|`)?\s{0,50}(:|=>|=)\s{0,50}(\"|'|`)?[A-Za-z0-9/+=]{16,}(\"|'|`)?)
(?i)artifactory.{0,50}(\"|'|`)?[a-zA-Z0-9=]{112}(\"|'|`)?
(?i)codeclima.{0,50}(\"|'|`)?[0-9a-f]{64}(\"|'|`)?
EAACEdEose0cBA[0-9A-Za-z]+
((\"|'|`)?type(\"|'|`)?\s{0,50}(:|=>|=)\s{0,50}(\"|'|`)?service_account(\"|'|`)?,?)
(?:r|s)k_[live|test]_[0-9a-zA-Z]{24}
[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com
AIza[0-9A-Za-z\-_]{35}
ya29\.[0-9A-Za-z\-_]+
sk_[live|test]_[0-9a-z]{32}
sq0atp-[0-9A-Za-z\-_]{22}
sq0csp-[0-9A-Za-z\-_]{43}
access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}
amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
SK[0-9a-fA-F]{32}
SG\.[0-9A-Za-z\-_]{22}\.[0-9A-Za-z\-_]{43}
key-[0-9a-zA-Z]{32}
[0-9a-f]{32}-us[0-9]{12}
sshpass -p.*['|\"]
https\\://outlook\\.office.com/webhook/[0-9a-f-]{36}\\@
(?i)sauce.{0,50}(\"|'|`)?[0-9a-f-]{36}(\"|'|`)?
(xox[pboa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})
https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}
(?i)sonar.{0,50}(\"|'|`)?[0-9a-f]{40}(\"|'|`)?
(?i)hockey.{0,50}(\"|'|`)?[0-9a-f]{32}(\"|'|`)?
([\w+]{1,24})(://)([^$<]{1})([^\s";]{1,}):([^$<]{1})([^\s";/]{1,})@[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,24}([^\s]+)
oy2[a-z0-