HaE - Highlighter and Extractor （信息高亮与提取）
HAE下载地址：https://github.com/gh0stkey/HaE/releases/tag/1.5.1HAE使用方法：https://github.com/gh0stkey/HaE/blob/master/README_zh.md使用案例参考：BurpSuite系列 | HaE与Authz高效漏洞挖掘https://mp.weixin.qq.com/s/5vNn7dMRZBtv0ojPBAHV7Q
HAE打包命令gradle fatJar （需先配置gradle环境）
JSON排序在线工具-BeJSON.comhttps://www.bejson.com/json/jsonsort在线JSON校验格式化工具（Be JSON）https://www.bejson.com/json/format/
公共规则网站https://gh0st.cn/HaE/
"Alibaba OSS": {"loaded": true,"regex": "([A|a]ccess[K|k]ey[I|i][d|D]|[A|a]ccess[K|k]ey[S|s]ecret)","color": "green","engine": "dfa","scope": "any","action": "any"},"Linkfinder": {"loaded": false,"regex": "(?:"|')(((?:[a-zA-Z]{1,10}://|//)[^"'/]{1,}\.[a-zA-Z]{2,}[^"']{0,})|((?:/|\.\./|\./)[^"'><,;|*()(%%$^/\\\[\]][^"'><,;|()]{1,})|([a-zA-Z0-9_\-/]{1,}/[a-zA-Z0-9_\-/]{1,}\.(?:[a-zA-Z]{1,4}|action)(?:[\?|#][^"|']{0,}|))|([a-zA-Z0-9_\-/]{1,}/[a-zA-Z0-9_\-/]{3,}(?:[\?|#][^"|']{0,}|))|([a-zA-Z0-9_\-]{1,}\.(?:php|asp|aspx|jsp|json|action|html|js|txt|xml|do|jspx|htm)(?:[\?|#][^"|']{0,}|)))(?:"|')","color": "gray","engine": "nfa","scope": "response","action": "any"},"Windows Path": {"loaded": true,"regex": "([a-zA-Z]:[\\/](?:[a-zA-Z0-9\.\-_ ]+[\\/])*([a-zA-Z0-9\.\-_ ]+))","color": "green","engine": "dfa","scope": "response","action": "any"},"Fingerprint: Nagios": {"loaded": true,"regex": "(Nagios access)","color": "gray","engine": "dfa","scope": "response","action": "any"},
（真不错）
Java 正则表达式 | 菜鸟教程https://www.runoob.com/java/java-regular-expressions.html
基本概念：确定有限自动机(Deterministic Finite Automaton) 简称DFA。dfa是匹配速度，是确定的。非确定有限自动机(Nondeterministic Finite Automaton) 简称NFA,nfa是匹配结果，是不确定的。区别：DFA比较快，但不提供Backtrack（回溯）功能，NFA比较慢，但提供了Backtrack功能。NFA是基于表达式的（Regex-Directed），而DFA是基于文本的（Text-Directed）。DFA引擎在任意时刻必定处于某个确定的状态，而NFA引擎可能处于一组状态之中的任何一个，所以，NFA引擎必须记录所有的可能路径，NFA之所以能够提供Backtrack的功能，原因就在这里。
python3 -m http.server 8000<html><body><h1>TEST</h1>access_keyAccesskeyaccesskeyid:222;AccesskeyID=111111</body></html>
public static String excludeSuffix = "";public static String[] excludeMIME = new String[] {};
#AliyunAccessKey (OK NFA)([A|a][Cc]{2}[Ee][Ss]{2}[Kk][Ee][Yy][Ii]?[Dd]?[Ss]?[Ee]?[Cc]?[Rr]?[Ee]?[Tt]?[=: "]{0,4}[w]{0,})#手机号 (OK NFA)[^(0-9)]+(1[3-9]d{9})[^(0-9)]#身份证 (OK NFA)[^(0-9)]((d{8}(0d|10|11|12)([0-2]d|30|31)d{3}$)|(d{6}(18|19|20)d{2}(0[1-9]|10|11|12)([0-2]d|30|31)d{3}(d|X|x)))[^(0-9)]#密码字段Passwd (OK NFA)(["]?([Pp][Aa]?[Ss]{0,2}[Ww][Oo]?[Rr]?[Dd]["s]?[=: "s]{0,4}.*?)[s;"])|(["]?([Pp][Aa][Ss]{2}[^Ww]["s]?[=: "s]{0,4}.*?)[s;"])#邮箱Email (OK NFA)(([a-zA-Z0-9][_|.])*[a-zA-Z0-9]+@([a-zA-Z0-9][-|_|.])*[a-zA-Z0-9]+.((?!js|css|jpg|jpeg|png|ico)[a-zA-Z]{2,}))#Aliyun_oss_url (OK NFA)([w-.]+.oss.aliyuncs.com)#Secret_key (OK NFA)([Ss][Ee][Cc][Rr][Ee][Tt][_]?[Kk][Ee][Yy][=: "]{0,4}[w]{0,})#Internal IPv4 (OK NFA)((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3})#Internal IPv6 (OK NFA)(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))#Public Linkfinder (OK NFA)(?:"|')(((?:[a-zA-Z]{1,10}://|//)[^"'/]{1,}.[a-zA-Z]{2,}[^"']{0,})|((?:/|../|./)[^"'><,;|*()(%%$^/\[]][^"'><,;|()]{1,})|([a-zA-Z0-9_-/]{1,}/[a-zA-Z0-9_-/]{1,}.(?:[a-zA-Z]{1,4}|action)(?:[?|#][^"|']{0,}|))|([a-zA-Z0-9_-/]{1,}/[a-zA-Z0-9_-/]{3,}(?:[?|#][^"|']{0,}|))|([a-zA-Z0-9_-]{1,}.(?:php|asp|aspx|jsp|json|action|html|js|txt|xml|do|jspx|htm)(?:[?|#][^"|']{0,}|)))(?:"|')#AWS ClientID (OK NFA|DFA)(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}#Windows Path (OK NFA|DFA)([a-zA-Z]:[\/]{1,2}(?:[a-zA-Z0-9.-_ ]+[\/]{1,2})*([a-zA-Z0-9.-_ ]+))
END
本文始发于微信公众号（NOVASEC）：BurpSuite插件-HAE修改、测试、规则分享
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论