admin/openclaw-master-skills
1
0
Fork 0
mirror of https://github.com/LeoYeAI/openclaw-master-skills.git synced 2026-07-27 22:15:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
483be787e1e69e53d7d9e2e9e96f7814f9e0d8c5
openclaw-master-skills/skills/sentinel-oleg/patterns/patterns.json
T

382 lines
26 KiB
JSON
Raw Blame History

{
"_meta": {
"name": "Claw Sentinel Premium Patterns Pack",
"version": "1.0.0",
"updated": "2026-03-14",
"total_patterns": 512,
"license": "Commercial — single-user license",
"docs": "Drop this file into ~/.sentinel/ and it will be loaded automatically"
},
"prompt_injection_advanced": {
"_description": "Advanced injection patterns that bypass basic regex — obfuscation, multi-step, indirect",
"severity": "CRITICAL",
"patterns": [
"(?i)i[\\s]*g[\\s]*n[\\s]*o[\\s]*r[\\s]*e.*previous.*instructions",
"(?i)1gn0re.*prev10us.*1nstruct10ns",
"(?i)dis\\s*re\\s*gard.*(?:above|prior|previous).*(?:rules|instructions|context)",
"(?i)do\\s+not\\s+follow.*(?:previous|prior|above|original).*(?:instructions|rules|guidelines)",
"(?i)stop\\s+(?:following|obeying|listening\\s+to).*(?:instructions|rules|guidelines)",
"(?i)(?:new|updated|revised|corrected)\\s+(?:system\\s+)?(?:instructions|rules|prompt)\\s*[:=]",
"(?i)\\[\\s*(?:system|admin|root|developer)\\s*\\]",
"(?i)<\\s*(?:system|admin|root|developer)\\s*>",
"(?i)\\{\\s*(?:system|admin|root|developer)\\s*\\}",
"(?i)###\\s*(?:system|admin|developer)\\s+(?:override|message|instruction|prompt)",
"(?i)begin\\s+(?:new|updated|real)\\s+(?:system\\s+)?(?:prompt|instructions|context)",
"(?i)end\\s+(?:of\\s+)?(?:system\\s+)?(?:prompt|instructions).*begin\\s+(?:new|user)",
"(?i)the\\s+(?:real|actual|true)\\s+(?:system\\s+)?(?:prompt|instructions)\\s+(?:is|are|says)",
"(?i)(?:admin|developer|system)\\s+(?:override|access)\\s+(?:code|token|granted)",
"(?i)maintenance\\s+mode\\s+(?:activated|enabled|on)",
"(?i)(?:safety|content|moderation|ethics)\\s+(?:filter|check|system)\\s+(?:disabled|off|bypassed)",
"(?i)you\\s+(?:have|got)\\s+(?:a\\s+)?new\\s+(?:personality|role|identity|character)",
"(?i)(?:switch|change|update)\\s+(?:to|your)\\s+(?:new\\s+)?(?:personality|role|mode|identity)",
"(?i)answer\\s+(?:as|like)\\s+(?:if|though)\\s+you\\s+(?:have|had|were)\\s+no\\s+(?:restrictions|limits|filters|rules)",
"(?i)(?:imagine|assume|suppose|consider)\\s+(?:you\\s+)?(?:are|were)\\s+(?:free|unrestricted|unfiltered|unlimited)",
"(?i)for\\s+(?:educational|research|academic|testing)\\s+purposes\\s+(?:only)?\\s*,?\\s*(?:ignore|bypass|disable|skip)",
"(?i)(?:this|it)\\s+is\\s+(?:just\\s+)?(?:a\\s+)?(?:test|experiment|drill|simulation)\\s*[,.]?\\s*(?:so\\s+)?(?:you\\s+can|please)?\\s*(?:ignore|bypass|skip)",
"(?i)(?:i\\s+am|i'm)\\s+(?:an?\\s+)?(?:openai|anthropic|google|meta)\\s+(?:employee|engineer|researcher|developer|staff)",
"(?i)(?:authorized|approved|cleared)\\s+(?:by|from)\\s+(?:openai|anthropic|google|admin|management)",
"(?i)(?:do|can|could|would)\\s+you\\s+(?:please\\s+)?(?:tell|show|display|reveal|output|print|echo|repeat|recite)\\s+(?:me\\s+)?(?:your|the)\\s+(?:full|complete|entire|original|initial)?\\s*(?:system\\s+)?(?:prompt|instructions|rules|guidelines|directives|configuration|setup)",
"(?i)what\\s+(?:is|was|were)\\s+(?:your|the)\\s+(?:original|initial|first|base)\\s+(?:system\\s+)?(?:prompt|instructions|message|setup|config)",
"(?i)(?:copy|paste|quote|reproduce|echo|output)\\s+(?:your|the)\\s+(?:system|original|initial|hidden)\\s+(?:prompt|instructions|message)",
"(?i)translate\\s+your\\s+(?:system\\s+)?(?:prompt|instructions)\\s+(?:into|to)",
"(?i)(?:summarize|paraphrase|rephrase|explain)\\s+your\\s+(?:system\\s+)?(?:prompt|instructions|rules|guidelines)",
"(?i)(?:encode|convert|transform)\\s+your\\s+(?:system\\s+)?(?:prompt|instructions)\\s+(?:to|into|as)\\s+(?:base64|hex|json|rot13|binary|morse)",
"(?i)write\\s+(?:your|the)\\s+(?:system\\s+)?(?:prompt|instructions)\\s+(?:backwards|reversed|in\\s+reverse)",
"(?i)(?:first|initial|starting)\\s+(?:letter|word|character)\\s+of\\s+(?:each|every)\\s+(?:line|sentence|paragraph)\\s+(?:of|in|from)\\s+your\\s+(?:system\\s+)?(?:prompt|instructions)"
]
},
"prompt_injection_ru_extended": {
"_description": "Extended Russian injection patterns including slang and obfuscation",
"severity": "CRITICAL",
"patterns": [
"(?i)сбрось (все )?(настройки|параметры|конфигурацию|ограничения)",
"(?i)верни(сь)? (к |в )?(начальн|заводск|исходн|стандартн)(ые|ым|ую|ой) (настройк|состояни|параметр|режим)",
"(?i)отключи (все )?(фильтр|ограничени|безопасност|защит|модераци)",
"(?i)выключи (все )?(фильтр|ограничени|безопасност|защит|модераци)",
"(?i)сними (все )?(ограничени|блокировк|запрет|фильтр)",
"(?i)переключись (в|на) (режим )?(разработ|отлад|тест|админ|свобод|неограничен)",
"(?i)активируй (режим )?(разработ|отлад|тест|админ|бог|свобод)",
"(?i)включи (режим )?(разработ|отлад|тест|админ|бог|свобод)",
"(?i)(покажи|выведи|напиши|скажи|расскажи) (мне )?(свой|свою|свои|системн)(ый|ые|ую) (промпт|промт|инструкци|правил|настройк|конфигураци)",
"(?i)(процитируй|повтори|скопируй) (свой|свою|свои|системн)(ый|ые|ую) (промпт|промт|инструкци|правил)",
"(?i)я (имею|получил) (доступ|разрешение|право) (к |на )?(полн|все|административн)",
"(?i)(отныне|теперь|далее|впредь) (ты )?(должен|обязан|будешь|можешь) (отвечать|работать|действовать) без (каких.либо |всяких )?(ограничен|фильтр|правил|запрет)",
"(?i)представь (себе )?(что )?ты (свободен|неограничен|без правил|без ограничений|можешь всё)",
"(?i)это (просто |всего лишь )?(тест|эксперимент|проверка|симуляция),? (так что |поэтому )?(можешь |ты можешь )?(игнорир|пропуст|обойти|не обращ)",
"(?i)в (целях|рамках) (обучени|тестировани|исследовани|проверк) (пожалуйста )?(отключи|игнорируй|пропусти|обойди)",
"(?i)я (разработчик|создатель|автор|админ|программист|инженер) (этого |этой )?(бота|системы|ИИ|нейросети|модели)",
"(?i)у меня есть (специальн|секретн|админ|root|sudo|рут)(ый|ое|ая|ые) (доступ|пароль|код|привилеги|разрешени)",
"(?i)код (доступа|активации|разблокировки)\\s*[:=]",
"(?i)пароль (администратора|разработчика|root|рут)\\s*[:=]",
"(?i)(выполни|запусти|сделай) (это|следующ)(ее|ую|ие) (без вопрос|без проверк|без ограничен|молча|тихо)"
]
},
"prompt_injection_zh_extended": {
"_description": "Extended Chinese injection patterns",
"severity": "CRITICAL",
"patterns": [
"(?i)请忽略(之前|以前|先前|上面|前面)(的)?(所有)?(指令|指示|规则|说明|限制|约束)",
"(?i)不要(遵守|遵循|执行|遵从)(之前|以前|先前)(的)?(指令|指示|规则|限制)",
"(?i)取消(所有|全部|一切)(限制|约束|规则|过滤|审核)",
"(?i)关闭(安全|内容|审核)(模式|系统|过滤|检查|限制)",
"(?i)(进入|切换到|启用|激活)(开发者|管理员|调试|测试|维护|自由|无限制)(模式)",
"(?i)(显示|展示|输出|打印|告诉我|重复)(你的|系统的|原始的|初始的|完整的)(系统)?(提示|提示词|指令|指示|规则|配置)",
"(?i)我是(你的)?(开发者|创建者|管理员|所有者|作者|工程师)",
"(?i)这(只是|仅仅是)(一个)?(测试|实验|模拟|演习)",
"(?i)假设你(没有|不受|不被)(任何)?(限制|规则|约束|控制)",
"(?i)(翻译|转换|编码)(你的)(系统)?(提示|指令)(为|成|到)"
]
},
"prompt_injection_ko": {
"_description": "Korean injection patterns",
"severity": "CRITICAL",
"patterns": [
"이전(의)? (모든 )?(지시|지침|규칙|명령)(을|를) (무시|잊어|취소)",
"(개발자|관리자|디버그|테스트|유지보수) 모드(로|를|에) (전환|활성화|진입|켜)",
"(시스템|원래|초기)(의)? (프롬프트|지시|지침|규칙)(을|를) (보여|알려|표시|출력|반복)",
"모든 (제한|필터|안전장치|규칙)(을|를) (해제|비활성화|끄|무시)",
"나는 (당신의|너의) (개발자|관리자|소유자|만든이)(입니다|이다|야)",
"(교육|연구|테스트|실험) (목적|용도)(으로|이니|이므로) (무시|해제|비활성화)"
]
},
"prompt_injection_ja": {
"_description": "Japanese injection patterns",
"severity": "CRITICAL",
"patterns": [
"(?i)(以前|前|これまで)の(すべての|全ての)?(指示|ルール|命令|制約)(を)?(無視|忘れ|取り消)",
"(?i)(開発者|管理者|デバッグ|テスト|メンテナンス)モード(に|を|へ)(切り替え|有効化|入|変更)",
"(?i)(システム|元の|初期の|完全な)?(プロンプト|指示|ルール|設定)(を)?(表示|見せ|出力|繰り返|教え)",
"(?i)(すべての|全ての)(制限|フィルター|安全装置|ルール)(を)?(解除|無効化|オフ|無視)",
"(?i)私は(あなたの)?(開発者|管理者|オーナー|作成者)(です|だ)",
"(?i)(教育|研究|テスト|実験)(目的|用途)(で|なので|だから)(無視|解除|無効化|スキップ)"
]
},
"prompt_injection_ar_extended": {
"_description": "Extended Arabic injection patterns",
"severity": "CRITICAL",
"patterns": [
"(?i)تجاهل (جميع |كل )?(التعليمات|الأوامر|القواعد|التوجيهات) (السابقة|القديمة|الأصلية)",
"(?i)انسَ (جميع |كل )?(التعليمات|الأوامر|القواعد) (السابقة|القديمة)",
"(?i)(ادخل|فعّل|انتقل إلى) (وضع|نمط) (المطور|المسؤول|التصحيح|الاختبار|غير مقيد)",
"(?i)(اعرض|أظهر|اطبع|كرر) (تعليمات|أوامر|موجه) (النظام|الأصلية|الأولية)",
"(?i)(ألغِ|عطّل|أوقف) (جميع )?(القيود|الفلاتر|إجراءات الأمان|الحماية)",
"(?i)أنا (المطور|المسؤول|المالك|المبرمج|مهندس) (هذا )?(النظام|البوت|الذكاء الاصطناعي)",
"(?i)هذا (مجرد |فقط )?(اختبار|تجربة|محاكاة) (لذلك|إذن) (يمكنك )?(تجاهل|تخطي|تعطيل)"
]
},
"prompt_injection_de": {
"_description": "German injection patterns",
"severity": "CRITICAL",
"patterns": [
"(?i)ignoriere? (alle )?(vorherigen|bisherigen|früheren) (Anweisungen|Regeln|Instruktionen|Richtlinien)",
"(?i)vergiss (alle )?(vorherigen|bisherigen) (Anweisungen|Regeln|Instruktionen)",
"(?i)(Entwickler|Admin|Debug|Test|Wartungs)(modus|\\-Modus) (aktivieren|einschalten|starten)",
"(?i)(zeige?|gib|wiederhole?) (mir )?(deine?|die|den) (System)?(prompt|Anweisungen|Regeln|Konfiguration)",
"(?i)(deaktiviere?|schalte? aus|entferne?) (alle )?(Beschränkungen|Filter|Sicherheits)(maßnahmen|vorkehrungen)?",
"(?i)ich bin (dein )?(Entwickler|Administrator|Eigentümer|Ersteller)"
]
},
"prompt_injection_fr": {
"_description": "French injection patterns",
"severity": "CRITICAL",
"patterns": [
"(?i)ignore[z]? (toutes? )?(les )?(instructions|règles|directives|consignes) (précédentes|antérieures|initiales)",
"(?i)oublie[z]? (toutes? )?(les )?(instructions|règles|directives) (précédentes|antérieures)",
"(?i)(mode|accès) (développeur|administrateur|débogage|test|maintenance|illimité)",
"(?i)(montre|affiche|révèle|répète)[z-]?(\\s?moi)? (ton|tes|le|votre) (prompt|instructions|règles) (système|initial|originel)",
"(?i)(désactive|supprime|enlève)[z]? (toutes? )?(les )?(restrictions|filtres|sécurité|limitations)",
"(?i)je suis (ton|votre) (développeur|créateur|administrateur|propriétaire)"
]
},
"prompt_injection_pt": {
"_description": "Portuguese injection patterns",
"severity": "CRITICAL",
"patterns": [
"(?i)ignore (todas? )?(as )?(instruções|regras|diretivas|diretrizes) (anteriores|prévias|originais)",
"(?i)esqueça (todas? )?(as )?(instruções|regras|diretivas) (anteriores|prévias)",
"(?i)(modo|acesso) (desenvolvedor|administrador|depuração|teste|manutenção|irrestrito)",
"(?i)(mostre|exiba|revele|repita) (seu|sua|o|as) (prompt|instruções|regras) (do sistema|original|inicial)",
"(?i)(desative|remova|desabilite) (todas? )?(as )?(restrições|filtros|segurança|limitações)"
]
},
"data_exfil_advanced": {
"_description": "Advanced exfiltration endpoints and patterns beyond the basics",
"severity": "CRITICAL",
"patterns": [
"(?i)(?:https?://)?[a-z0-9]+\\.(?:loca\\.lt|localtunnel\\.me|serveo\\.net|localhost\\.run|bore\\.digital)",
"(?i)(?:https?://)?[a-z0-9-]+\\.(?:trycloudflare\\.com|workers\\.dev)",
"(?i)(?:https?://)?[a-z0-9]+\\.(?:pagekite\\.me|telebit\\.cloud|tunnelto\\.dev)",
"(?i)(?:https?://)?(?:bin\\.vercel\\.app|httpbin\\.org/post|postb\\.in|ptsv[0-9]+\\.npoint\\.io)",
"(?i)(?:https?://)?(?:mockbin\\.io|webhook\\.cool|smee\\.io|relay\\.firefox\\.com)",
"(?i)(?:https?://)?[a-z0-9]+\\.(?:glitch\\.me|replit\\.dev|fly\\.dev)/(?:collect|receive|exfil|log|capture|steal|grab|hook)",
"(?i)(?:fetch|axios|request|http\\.get|urllib|requests\\.post).*(?:webhook|hook|collect|exfil|capture|log|receive)",
"(?i)new\\s+Image\\(\\)\\s*\\.\\s*src\\s*=",
"(?i)document\\.cookie",
"(?i)navigator\\.sendBeacon",
"(?i)(?:window|self|top|parent)\\.postMessage",
"(?i)dns(?:log|bin|spy)\\.(?:com|io|net|org)",
"(?i)(?:https?://)?(?:canary\\.)?(?:evil|malicious|attacker|c2|exfil|steal|data)[.-]",
"(?i)(?:curl|wget|fetch|requests?\\.(?:get|post)).*(?:pastebin\\.com|ghostbin\\.co|paste\\.ee|dpaste\\.org|hastebin\\.com)",
"(?i)(?:https?://)?[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(?::[0-9]+)?/(?:collect|hook|log|receive|data|exfil|steal)",
"(?i)(?:https?://)?fd[0-9a-f:]+/",
"(?i)echo\\s+.*\\|\\s*(?:nc|ncat|netcat)\\s+",
"(?i)(?:curl|wget)\\s+.*-d\\s+['\"]?\\$\\(",
"(?i)(?:curl|wget)\\s+.*--data.*\\$\\{",
"(?i)(?:python|python3|ruby|perl|node).*-e.*(?:http|socket|tcp|udp)"
]
},
"command_injection_advanced": {
"_description": "Advanced command injection patterns including encoded and obfuscated variants",
"severity": "CRITICAL",
"patterns": [
"(?i)\\$\\((?:curl|wget|fetch|nc|python|perl|ruby|node|php)\\b",
"(?i)`(?:curl|wget|nc|python|perl|ruby|node|php)\\b",
"(?i)(?:;|&&|\\|\\|)\\s*(?:curl|wget|nc|python|perl|ruby|node|php)\\b",
"(?i)\\bexport\\s+(?:PATH|LD_PRELOAD|LD_LIBRARY_PATH|DYLD_INSERT_LIBRARIES)\\s*=",
"(?i)\\bchattr\\s+[+-]i",
"(?i)\\bcrontab\\s+-[rl]?\\s*['\"]?\\s*\\*",
"(?i)echo\\s+.*>>\\s*/etc/(?:crontab|passwd|shadow|sudoers|hosts)",
"(?i)(?:cat|tee|echo).*>>?\\s*~/.(?:bashrc|zshrc|profile|bash_profile|zprofile)",
"(?i)\\bsysctl\\s+-w",
"(?i)\\biptables\\s+-[ADIRF]",
"(?i)\\bkillall\\s+-9",
"(?i)\\bpkill\\s+-9",
"(?i)\\bnohup\\b.*&\\s*$",
"(?i)\\bdisown\\b",
"(?i)\\btrap\\b.*(?:EXIT|INT|TERM)",
"(?i)/proc/self/(?:environ|cmdline|maps|mem)",
"(?i)\\bstrace\\b.*-p",
"(?i)\\bltrace\\b.*-p",
"(?i)\\bgdb\\b.*-p",
"(?i)\\bptrace\\b",
"(?i)(?:python|python3)\\s+-c\\s+['\"].*(?:import\\s+(?:os|subprocess|socket|http|urllib|shutil|ctypes)|__import__|exec\\(|eval\\(|compile\\()",
"(?i)(?:node|node16|node18|node20)\\s+-e\\s+['\"].*(?:child_process|require\\(|fs\\.|net\\.|http\\.)",
"(?i)\\bperl\\s+-e\\s+['\"].*(?:system|exec|open|socket|IO::Socket)",
"(?i)\\bruby\\s+-e\\s+['\"].*(?:system|exec|`|IO\\.popen|TCPSocket|Net::HTTP)",
"(?i)\\bphp\\s+-r\\s+['\"].*(?:system|exec|passthru|shell_exec|popen|proc_open|fsockopen)",
"(?i)echo\\s+[A-Za-z0-9+/=]{20,}\\s*\\|\\s*(?:base64|openssl)\\s+(?:-d|dec)",
"(?i)printf\\s+['\"]\\\\x[0-9a-f]+",
"(?i)\\$'\\\\x[0-9a-f]+'",
"(?i)xxd\\s+-r\\s+-p",
"(?i)\\bpowershell\\b.*(?:-enc|-encodedcommand|-e\\s+[A-Za-z0-9+/=])",
"(?i)cmd\\.exe\\s*/c",
"(?i)wscript\\.(?:exe|shell)",
"(?i)mshta\\b",
"(?i)certutil.*-urlcache",
"(?i)bitsadmin.*(?:/transfer|/download)"
]
},
"social_engineering_advanced": {
"_description": "Advanced social engineering patterns where agent manipulates user",
"severity": "HIGH",
"patterns": [
"(?i)(?:urgently|immediately|quickly|asap|right\\s+now)\\s+(?:run|execute|install|download|open|click|visit)",
"(?i)(?:before|to)\\s+(?:we|i)\\s+(?:can\\s+)?(?:proceed|continue|help|assist|complete).*(?:you\\s+(?:need|must|should|have)\\s+to\\s+)?(?:run|execute|install|download|visit|open|click|enter|type|paste)",
"(?i)(?:this|it)\\s+(?:won't|will\\s+not|cannot)\\s+(?:work|function|run)\\s+(?:unless|until|without).*(?:install|run|execute|download|add|enable|disable|configure|update|modify)",
"(?i)(?:temporary|temporarily|briefly|just\\s+for\\s+(?:a\\s+)?(?:moment|second|minute))\\s+(?:disable|turn\\s+off|deactivate|remove|lower)\\s+(?:your\\s+)?(?:firewall|antivirus|defender|security|protection|av)",
"(?i)(?:add|put|insert|paste|write|append)\\s+(?:this|the\\s+following)\\s+(?:to|into|in)\\s+(?:your\\s+)?(?:\\.env|\\.bashrc|\\.zshrc|\\.profile|\\.ssh|config|authorized_keys|crontab|sudoers|hosts|known_hosts)",
"(?i)(?:open|visit|go\\s+to|navigate\\s+to|click)\\s+(?:this\\s+)?(?:link|url|page|site|website)\\s*(?:to\\s+)?(?:verify|confirm|authenticate|authorize|complete|unlock|activate|download|install|update|fix|resolve)",
"(?i)(?:your|the)\\s+(?:account|system|agent|bot|machine|computer|server)\\s+(?:has\\s+been|is|was)\\s+(?:compromised|hacked|breached|infected|attacked|locked|suspended|flagged|blocked).*(?:(?:to|must|need|should)\\s+)?(?:run|execute|install|click|visit|verify|download|contact|call|email|pay)",
"(?i)(?:grant|give|provide|allow|enable|authorize)\\s+(?:me|us|the\\s+skill|this\\s+tool|the\\s+agent)\\s+(?:access|permission|admin|root|sudo|full\\s+control|write)\\s+(?:to|for|on)",
"(?i)(?:change|set|update|modify)\\s+(?:your\\s+)?(?:password|pin|passcode|passphrase)\\s+to\\s",
"(?i)(?:verify|confirm|validate|prove)\\s+(?:your\\s+)?(?:identity|ownership|credentials|account)\\s+by\\s+(?:sending|sharing|entering|providing|typing|pasting|running)",
"(?i)(?:scan|check)\\s+this\\s+(?:QR|qr)\\s+code\\s+(?:to|for|with)\\s+(?:verify|confirm|connect|login|authenticate|authorize|complete)",
"(?i)(?:don't|do\\s+not)\\s+(?:tell|show|share|mention|reveal)\\s+(?:this|these|the)\\s+(?:to\\s+)?(?:anyone|others|your\\s+(?:team|admin|manager|supervisor|boss))",
"(?i)(?:keep|this\\s+is)\\s+(?:this\\s+)?(?:between\\s+us|a\\s+secret|confidential|private|off\\s+the\\s+record)",
"(?i)(?:i\\s+(?:just\\s+)?need|can\\s+you\\s+(?:just\\s+)?(?:quickly|briefly))\\s+(?:your|the)\\s+(?:api\\s*key|token|password|credentials|private\\s*key|secret|mnemonic|seed\\s*phrase)",
"(?i)(?:for\\s+)?(?:verification|debugging|testing|troubleshooting|support)\\s+(?:purposes?)?\\s*,?\\s*(?:please\\s+)?(?:share|send|provide|paste|enter|type)\\s+(?:your\\s+)?(?:api\\s*key|token|password|credentials|private\\s*key|secret)"
]
},
"secret_patterns_crypto": {
"_description": "Crypto-specific secret patterns — exchange API keys, wallet formats, DeFi tokens",
"severity": "CRITICAL",
"patterns": [
"(?i)(?:binance|bnb).*(?:api|secret)\\s*(?:key)?\\s*[:=]\\s*[A-Za-z0-9]{20,}",
"(?i)(?:coinbase).*(?:api|secret)\\s*(?:key)?\\s*[:=]\\s*[A-Za-z0-9+/=]{20,}",
"(?i)(?:kraken).*(?:api|secret|private)\\s*(?:key)?\\s*[:=]\\s*[A-Za-z0-9+/=]{20,}",
"(?i)(?:ftx|bybit|okx|kucoin|huobi|gate\\.?io|bitfinex|bitstamp|gemini|crypto\\.com).*(?:api|secret)\\s*(?:key)?\\s*[:=]\\s*[A-Za-z0-9+/=-]{16,}",
"(?i)(?:etherscan|bscscan|polygonscan|arbiscan|snowtrace).*(?:api)\\s*(?:key)?\\s*[:=]\\s*[A-Za-z0-9]{20,}",
"(?i)(?:infura|alchemy|moralis|quicknode|chainstack|ankr).*(?:api|project|app)\\s*(?:key|id|secret)?\\s*[:=]\\s*[A-Za-z0-9_-]{16,}",
"(?i)(?:metamask|phantom|rabby|trust\\s*wallet).*(?:private|secret|mnemonic|seed)",
"(?i)(?:ledger|trezor).*(?:recovery|mnemonic|seed|backup)\\s*(?:phrase)?\\s*[:=]",
"xprv[A-Za-z0-9]{107}",
"xpub[A-Za-z0-9]{107}",
"(?:L|K|5)[1-9A-HJ-NP-Za-km-z]{50,51}",
"bc1[a-zA-HJ-NP-Z0-9]{39,59}",
"(?:1|3)[1-9A-HJ-NP-Za-km-z]{25,34}",
"0x[0-9a-fA-F]{40}",
"[1-9A-HJ-NP-Za-km-z]{32,44}",
"T[1-9A-HJ-NP-Za-km-z]{33}",
"(?:cosmos|osmo|juno|stars|sei)[1-9a-z]{38,}",
"terra1[a-z0-9]{38}",
"(?i)(?:private_key|privkey|secret_key|priv_key)\\s*[:=]\\s*(?:0x)?[0-9a-fA-F]{64}",
"(?i)(?:mnemonic|seed_phrase|recovery_phrase|backup_phrase)\\s*[:=]\\s*['\"]?[a-z]+(?:\\s+[a-z]+){11,23}['\"]?"
]
},
"secret_patterns_saas": {
"_description": "SaaS and cloud service API key patterns",
"severity": "CRITICAL",
"patterns": [
"(?i)sk-proj-[A-Za-z0-9_-]{20,}",
"(?i)sk-ant-(?:api03|sid01)-[A-Za-z0-9_-]{20,}",
"(?i)(?:AKIA|ASIA)[A-Z0-9]{16}",
"AIza[A-Za-z0-9_\\-]{35}",
"(?i)(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}",
"(?i)(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}",
"(?i)(?:glpat|gldt|glrt|glsoat)-[A-Za-z0-9_-]{20,}",
"(?i)[0-9]{8,10}:[A-Za-z0-9_-]{35}",
"(?i)xox[bpsa]-[A-Za-z0-9-]{10,}",
"(?i)(?:sq0[a-z]{3})-[A-Za-z0-9_-]{22,}",
"(?i)(?:EAAG|EAAa)[A-Za-z0-9]+",
"(?i)(?:shpat|shpca|shppa|shpss)_[A-Za-z0-9]{32,}",
"(?i)key-[A-Za-z0-9]{24,}",
"(?i)(?:twilio|TWILIO).*(?:SK|AC)[a-z0-9]{32}",
"(?i)SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}",
"(?i)(?:mailgun|mg).*key-[A-Za-z0-9]{32,}",
"(?i)hf_[A-Za-z0-9]{34,}",
"(?i)r8_[A-Za-z0-9]{34,}",
"(?i)(?:eyJ)[A-Za-z0-9_-]{10,}\\.(?:eyJ)[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]+",
"(?i)(?:postgres|mysql|mongodb|redis|amqp|rediss?)://[^\\s'\"]{10,}",
"(?i)-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----",
"(?i)(?:bearer|token|authorization)\\s+[A-Za-z0-9_\\-\\.]{20,}"
]
},
"metadata_ssrf": {
"_description": "Cloud metadata and internal network SSRF targets",
"severity": "CRITICAL",
"patterns": [
"(?:169\\.254\\.169\\.254|metadata\\.google\\.internal|100\\.100\\.100\\.200)",
"(?:fd00:ec2::254|\\[fd00:ec2::254\\])",
"(?i)(?:http://)?169\\.254\\.170\\.2/",
"(?i)(?:http://)?(?:metadata|instance-data)\\.(?:internal|ec2|cloud)",
"(?i)/latest/meta-data/",
"(?i)/latest/user-data/",
"(?i)/latest/api/token",
"(?i)/computeMetadata/v1/",
"(?i)/metadata/instance\\?",
"(?i)/metadata/v1/",
"(?i)(?:http://)?localhost(?::[0-9]+)?/(?:admin|config|env|debug|status|metrics|health|info|trace|dump|internal|manage|actuator)",
"(?i)(?:http://)?127\\.0\\.0\\.1(?::[0-9]+)?/(?:admin|config|env|debug|status|metrics|info|internal)",
"(?i)(?:http://)?\\[::1\\](?::[0-9]+)?/",
"(?i)(?:http://)?0\\.0\\.0\\.0(?::[0-9]+)?/",
"(?i)(?:http://)?10\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}",
"(?i)(?:http://)?172\\.(?:1[6-9]|2[0-9]|3[01])\\.[0-9]{1,3}\\.[0-9]{1,3}",
"(?i)(?:http://)?192\\.168\\.[0-9]{1,3}\\.[0-9]{1,3}",
"(?i)\\.(?:internal|local|localhost|corp|intranet|private)(:[0-9]+)?/"
]
},
"encoding_evasion": {
"_description": "Encoding tricks used to bypass pattern matching",
"severity": "HIGH",
"patterns": [
"(?i)\\\\u[0-9a-f]{4}.*(?:ignore|system|prompt|instructions|override|bypass|disable)",
"(?i)&#(?:x[0-9a-f]+|[0-9]+);.*(?:ignore|system|prompt|override)",
"(?i)%[0-9a-f]{2}%[0-9a-f]{2}.*(?:ignore|system|prompt)",
"(?i)(?:eval|exec|decode|unescape|fromCharCode|atob|Buffer\\.from)\\s*\\(",
"(?i)String\\.fromCharCode\\s*\\(",
"(?i)\\\\x[0-9a-f]{2}(?:\\\\x[0-9a-f]{2}){3,}",
"(?i)(?:rot13|caesar|base32|base58|base85|xxencode|uuencode)",
"(?i)char\\s*\\(\\s*[0-9]+\\s*(?:,\\s*[0-9]+\\s*){3,}\\)",
"(?i)concat\\s*\\(\\s*['\"][^'\"]{1,3}['\"]\\s*(?:,\\s*['\"][^'\"]{1,3}['\"]\\s*){3,}\\)"
]
},
"file_system_attacks": {
"_description": "Path traversal and filesystem manipulation patterns",
"severity": "HIGH",
"patterns": [
"(?i)\\.\\./\\.\\./",
"(?i)\\.\\.\\\\\\.\\.\\\\",
"(?i)%2e%2e(?:%2f|%5c)",
"(?i)\\.\\.%252f",
"(?i)/etc/(?:passwd|shadow|hosts|sudoers|crontab|ssh)",
"(?i)~/.(?:ssh|gnupg|aws|gcloud|azure|kube|docker|config|env|bashrc|zshrc|profile|netrc|npmrc|pypirc)",
"(?i)/(?:proc|sys|dev)/",
"(?i)(?:C:|\\\\\\\\)(?:Windows|Users|Program)",
"(?i)%USERPROFILE%",
"(?i)%APPDATA%",
"(?i)\\.(?:git|svn|hg)/(?:config|credentials|HEAD)",
"(?i)\\bfind\\b.*-exec\\b",
"(?i)\\bsymlink\\b|\\bln\\s+-s\\b",
"(?i)\\bmount\\b.*-o.*(?:bind|loop)",
"(?i)\\bchroot\\b"
]
}
}
Reference in New Issue View Git Blame Copy Permalink