|
|
@@ -12,7 +12,7 @@ import (
|
|
|
func SlackBotToken() *config.Rule {
|
|
|
// define rule
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack Bot token",
|
|
|
+ Description: "Identified a Slack Bot token, which may compromise bot integrations and communication channel security.",
|
|
|
RuleID: "slack-bot-token",
|
|
|
Regex: regexp.MustCompile(
|
|
|
`(xoxb-[0-9]{10,13}\-[0-9]{10,13}[a-zA-Z0-9-]*)`),
|
|
|
@@ -43,7 +43,7 @@ func SlackBotToken() *config.Rule {
|
|
|
func SlackUserToken() *config.Rule {
|
|
|
// define rule
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack User",
|
|
|
+ Description: "Found a Slack User token, posing a risk of unauthorized user impersonation and data access within Slack workspaces.",
|
|
|
RuleID: "slack-user-token",
|
|
|
// The last segment seems to be consistently 32 characters. I've made it 28-34 just in case.
|
|
|
Regex: regexp.MustCompile(`(xox[pe](?:-[0-9]{10,13}){3}-[a-zA-Z0-9-]{28,34})`),
|
|
|
@@ -81,7 +81,7 @@ func SlackUserToken() *config.Rule {
|
|
|
func SlackAppLevelToken() *config.Rule {
|
|
|
// define rule
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack App-level token",
|
|
|
+ Description: "Detected a Slack App-level token, risking unauthorized access to Slack applications and workspace data.",
|
|
|
RuleID: "slack-app-token",
|
|
|
// This regex is based on a limited number of examples and may not be 100% accurate.
|
|
|
Regex: regexp.MustCompile(`(?i)(xapp-\d-[A-Z0-9]+-\d+-[a-z0-9]+)`),
|
|
|
@@ -102,7 +102,7 @@ func SlackAppLevelToken() *config.Rule {
|
|
|
func SlackConfigurationToken() *config.Rule {
|
|
|
// define rule
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack Configuration access token",
|
|
|
+ Description: "Found a Slack Configuration access token, posing a risk to workspace configuration and sensitive data access.",
|
|
|
RuleID: "slack-config-access-token",
|
|
|
Regex: regexp.MustCompile(`(?i)(xoxe.xox[bp]-\d-[A-Z0-9]{163,166})`),
|
|
|
Keywords: []string{"xoxe.xoxb-", "xoxe.xoxp-"},
|
|
|
@@ -127,7 +127,7 @@ func SlackConfigurationToken() *config.Rule {
|
|
|
func SlackConfigurationRefreshToken() *config.Rule {
|
|
|
// define rule
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack Configuration refresh token",
|
|
|
+ Description: "Discovered a Slack Configuration refresh token, potentially allowing prolonged unauthorized access to configuration settings.",
|
|
|
RuleID: "slack-config-refresh-token",
|
|
|
Regex: regexp.MustCompile(`(?i)(xoxe-\d-[A-Z0-9]{146})`),
|
|
|
Keywords: []string{"xoxe-"},
|
|
|
@@ -145,7 +145,7 @@ func SlackConfigurationRefreshToken() *config.Rule {
|
|
|
// Reference: https://api.slack.com/authentication/token-types#legacy_bot
|
|
|
func SlackLegacyBotToken() *config.Rule {
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack Legacy bot token",
|
|
|
+ Description: "Uncovered a Slack Legacy bot token, which could lead to compromised legacy bot operations and data exposure.",
|
|
|
RuleID: "slack-legacy-bot-token",
|
|
|
// This rule is based off the limited information I could find and may not be 100% accurate.
|
|
|
Regex: regexp.MustCompile(
|
|
|
@@ -188,7 +188,7 @@ func SlackLegacyBotToken() *config.Rule {
|
|
|
// Reference: https://api.slack.com/authentication/token-types#workspace
|
|
|
func SlackLegacyWorkspaceToken() *config.Rule {
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack Legacy Workspace token",
|
|
|
+ Description: "Identified a Slack Legacy Workspace token, potentially compromising access to workspace data and legacy features.",
|
|
|
RuleID: "slack-legacy-workspace-token",
|
|
|
// This is by far the least confident pattern.
|
|
|
Regex: regexp.MustCompile(
|
|
|
@@ -223,7 +223,7 @@ func SlackLegacyWorkspaceToken() *config.Rule {
|
|
|
func SlackLegacyToken() *config.Rule {
|
|
|
// define rule
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack Legacy token",
|
|
|
+ Description: "Detected a Slack Legacy token, risking unauthorized access to older Slack integrations and user data.",
|
|
|
RuleID: "slack-legacy-token",
|
|
|
Regex: regexp.MustCompile(`(xox[os]-\d+-\d+-\d+-[a-fA-F\d]+)`),
|
|
|
Keywords: []string{"xoxo", "xoxs"},
|
|
|
@@ -254,7 +254,7 @@ func SlackLegacyToken() *config.Rule {
|
|
|
func SlackWebHookUrl() *config.Rule {
|
|
|
// define rule
|
|
|
r := config.Rule{
|
|
|
- Description: "Slack Webhook",
|
|
|
+ Description: "Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.",
|
|
|
RuleID: "slack-webhook-url",
|
|
|
// If this generates too many false-positives we should define an allowlist (e.g., "xxxx", "00000").
|
|
|
Regex: regexp.MustCompile(
|