Merge pull request tomnomnom#6 from Shaddy/master

Syncing examples from ~/.gf/ @tomnomnom dotfiles.

examples/aws-keys.json

@@ -0,0 +1,4 @@
+{
+    "flags": "-HanrE",
+    "pattern": "([^A-Z0-9]|^)(AKIA|A3T|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{12,}"
+}

examples/base64.json

@@ -1,6 +1,6 @@
 {
     "flags": "-HnroE",
-    "pattern": "[^A-Za-z0-9+/](eyj|YTo|Tzo|PD[89])[%a-zA-Z0-9+/]+={0,2}"
+    "pattern": "([^A-Za-z0-9+/]|^)(eyJ|YTo|Tzo|PD[89]|aHR0cHM6L|aHR0cDo|rO0)[%a-zA-Z0-9+/]+={0,2}"
 }
 
 

examples/cors.json

@@ -0,0 +1,6 @@
+{
+    "flags": "-HnriE",
+    "patterns": [
+        "Access-Control-Allow"
+    ]
+}

examples/debug-pages.json

@@ -1,5 +1,5 @@
 {
     "flags": "-HnraiE",
-    "pattern": "(Application-Trace|Routing Error|DEBUG = True|Caused by:)"
+    "pattern": "(Application-Trace|Routing Error|DEBUG\"? ?[=:] ?True|Caused by:|stack trace:|Microsoft .NET Framework|Traceback|[0-9]:in `|#!/us|WebApplicationException|java\\.lang\\.|phpinfo|swaggerUi|on line [0-9]|SQLSTATE)"
 
 }

examples/firebase.json

@@ -0,0 +1,4 @@
+{
+    "flags": "-Hnri",
+    "pattern": "firebaseio.com"
+}

examples/fw.json

@@ -1,4 +1,29 @@
 {
     "flags": "-HnriE",
-    "pattern": "(django|laravel|symfony|graphite|grafana|drupal|struts|code ?igniter|cake ?php|grails|elastic ?search|kibana|log ?stash|tomcat|jenkins|hudson|jira)"
+    "patterns": [
+        "django",
+        "laravel",
+        "symfony",
+        "graphite",
+        "grafana",
+        "X-Drupal-Cache",
+        "struts",
+        "code ?igniter",
+        "cake ?php",
+        "grails",
+        "elastic ?search",
+        "kibana",
+        "log ?stash",
+        "tomcat",
+        "jenkins",
+        "hudson",
+        "com.atlassian.jira",
+        "Apache Subversion",
+        "Chef Server",
+        "RabbitMQ Management",
+        "Mongo",
+        "Travis CI - Enterprise",
+        "BMC Remedy",
+        "artifactory"
+    ]
 }

examples/go-functions.json

@@ -0,0 +1,4 @@
+{
+  "flags": "-HnriE",
+  "pattern": "func [a-z0-9_]+\\("
+}

examples/http-auth.json

@@ -0,0 +1,4 @@
+{
+    "flags": "-hrioaE",
+    "pattern": "[a-z0-9_/\\.:-]+@[a-z0-9-]+\\.[a-z0-9.-]+"
+}

examples/json-sec.json

@@ -0,0 +1,4 @@
+{
+    "flags": "-harioE",
+    "pattern": "(\\\\?\"|"|%22)[a-z0-9_-]*(api[_-]?key|S3|aws_|secret|passw|auth)[a-z0-9_-]*(\\\\?\"|"|%22): ?(\\\\?\"|"|%22)[^\"&]+(\\\\?\"|"|%22)"
+}

examples/meg-headers.json

@@ -0,0 +1,4 @@
+{
+    "flags": "-hroiE",
+    "pattern": "^\u003c [a-z0-9_\\-]+: .*"
+}

examples/php-errors.json

@@ -1,4 +1,17 @@
 {
     "flags": "-HnriE",
-    "pattern": "(php warning|php error|fatal error|uncaught exception|include_path|undefined index|undefined variable|\\?php|<\\?[^x])"
+    "patterns": [
+        "php warning",
+        "php error",
+        "fatal error",
+        "uncaught exception",
+        "include_path",
+        "undefined index",
+        "undefined variable",
+        "\\?php",
+        "<\\?[^x]",
+        "stack trace\\:",
+        "expects parameter [0-9]*",
+        "Debug Trace"
+    ]
 }

examples/php-serialized.json

@@ -0,0 +1,8 @@
+{
+    "flags": "-HnrE",
+    "patterns": [
+        "a:[0-9]+:{",
+        "O:[0-9]+:\"",
+        "s:[0-9]+:\""
+    ]
+}

examples/php-sinks.json

@@ -1,4 +1,4 @@
 {
     "flags": "-HnriE",
-    "pattern": "[^a-z0-9_](system|exec|popen|pcntl_exec|eval|create_function) ?\\("
+    "pattern": "[^a-z0-9_](system|exec|popen|pcntl_exec|eval|create_function|unserialize|file_exists|md5_file|filemtime|filesize|assert) ?\\("
 }

examples/s3-buckets.json

@@ -0,0 +1,10 @@
+{
+    "flags": "-hrioaE",
+    "patterns": [
+        "[a-z0-9.-]+\\.s3\\.amazonaws\\.com",
+        "[a-z0-9.-]+\\.s3-[a-z0-9-]\\.amazonaws\\.com",
+        "[a-z0-9.-]+\\.s3-website[.-](eu|ap|us|ca|sa|cn)",
+        "//s3\\.amazonaws\\.com/[a-z0-9._-]+",
+        "//s3-[a-z0-9-]+\\.amazonaws\\.com/[a-z0-9._-]+"
+    ]
+}

examples/sec.json

@@ -1,4 +1,4 @@
 {
     "flags": "-HanriE",
-    "pattern": "(aws_access|aws_secret|api[_-]?key|ListBucketResult|S3_ACCESS_KEY|Authorization:|RSA PRIVATE|Index of|aws-|aws_)"
+    "pattern": "(aws_access|aws_secret|api[_-]?key|ListBucketResult|S3_ACCESS_KEY|Authorization:|RSA PRIVATE|Index of|aws_|secret|ssh-rsa AA)"
 }

examples/servers.json

@@ -0,0 +1,5 @@
+{
+    "flags": "-hri",
+    "pattern": "server: ",
+    "unique": true
+}

examples/strings.json

@@ -0,0 +1,7 @@
+{
+    "flags": "-hroiaE",
+    "patterns": [
+        "\"[^\"]+\"",
+        "'[^']+'"
+    ]
+}

examples/takeovers.json

@@ -6,18 +6,14 @@
         "No Such Account",
         "You're Almost There",
         "a GitHub Pages site here",
-        "this shop is currently unavailable",
         "There's nothing here",
-        "The request could not be satisfied",
         "project not found",
         "Your CNAME settings",
         "InvalidBucketName",
         "PermanentRedirect",
         "The specified bucket does not exist",
         "Repository not found",
-        "Bad Request: ERROR: The request could not be satisfied",
         "Sorry, We Couldn't Find That Page",
-        "Fastly error: unknown domain:",
         "The feed has not been found.",
         "The thing you were looking for is no longer here, or never was",
         "Please renew your subscription",
@@ -27,10 +23,7 @@
         "No such app",
         "is not a registered InCloud YouTrack",
         "Unrecognized domain",
-        "Sorry, this shop is currently unavailable.",
-        "You are being redirected",
         "project not found",
-        "The requested URL was not found on this server.",
         "This UserVoice subdomain is currently available!",
         "Do you want to register",
         "Help Center Closed"

examples/upload-fields.json

@@ -0,0 +1,4 @@
+{
+  "flags": "-HnriE",
+  "pattern": "\u003cinput[^\u003e]+type=[\"']?file[\"']?"
+}