string_analyze/rules/core/
other.rs

1use crate::entropy::entropy;
2use crate::rules::lazy_rule;
3
4lazy_rule!(
5    RE_SET_KEY = r#"(?i)(?:key|token)[a-z0-9_\-\s]{0,15}[=|:][\s]{0,5}(?:"|')?[a-z0-9_\-\.\+\/]{8,256}(?:"|')?"#,
6    "发现 可疑key赋值",
7    50
8);
9
10lazy_rule!(
11    RE_TOR_ONION = r#"\b[a-z2-7]{16,56}\.onion\b"#,
12    "发现 暗网 Onion 链接",
13    50,
14    3.0
15);
16lazy_rule!(
17    RE_URL = r#"(?i)(?:https?|ftp)://(?:localhost|(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}|(?:\d{1,3}\.){3}\d{1,3})(?::\d{1,5})?(?:/[^\s<>\"'{}|\\^`\\]*)?"#,
18    "发现 URL 链接",
19    5
20);
21lazy_rule!(
22    RE_IPV4 = r#"\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b"#,
23    "发现 IPv4 地址",
24    10,
25    ((1, false, r"\."),(1, false, r"\."))
26);
27lazy_rule!(
28    RE_IPV6 = r#"\b(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:\b[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b"#,
29    "发现 IPv6 地址",
30    10,
31    2.0
32);
33lazy_rule!(
34    RE_MAC = r#"\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b"#,
35    "发现 mac 地址",
36    10
37);
38lazy_rule!(
39    RE_CIDR = r#"\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}\b"#,
40    "发现 CIDR",
41    10
42);
43lazy_rule!(
44    RE_CLOUD_BUCKET = r#"(?i)\b[a-z0-9.-]+\.(?:s3\.amazonaws\.com|oss-cn-[a-z0-9-]+\.aliyuncs\.com|cos\.ap-[a-z0-9-]+\.myqcloud\.com)\b"#,
45    "发现 云存储桶 URL (S3/OSS/COS)",
46    20
47);
48
49lazy_rule!(
50    RE_UUID = r#"(?i)[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"#,
51    "发现 UUID",
52    8
53);
54
55lazy_rule!(
56    RE_UNIX_TIMESTAMP = r#"\b1[0-9]{9,12}\b"#,
57    "UNIX_TIMESTAMP",
58    5
59);
60lazy_rule!(
61    RE_ISO8601_DATETIME = r#"\b\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])[T\s](?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d{1,9})?)?(?:Z|[+-](?:0[0-9]|1[0-4]):?[0-5]\d)?\b"#,
62    "发现 ISO8601 标准时间戳",
63    5
64);
65lazy_rule!(
66    RE_PATH_WIN = r#"(?i)^[a-z]:[/\\](?:[^\\/:*?"<>|\r\n\t]+[/\\])*[^\\/:*?"<>|\r\n\t]+"#,
67    "发现 Windows 绝对路径",
68    1
69);
70lazy_rule!(
71    RE_PATH_UNIX = r#"(?:~|(?:\.\./|\./)|/)[a-zA-Z0-9._-]+(?:/[a-zA-Z0-9._-]+)+"#,
72    "发现 Unix 路径",
73    1,
74    ((8, false, r"(?i)(?:[a-z]:?|https?:/?/?)$"), ) // (前断言, 后断言)
75);
76
77
78lazy_rule!(
79    HIGH_ENTROPY = |s| if s.input.len() <= 512 && entropy(s.input.as_bytes()) >= 5.1 { s.ranges.push((0,s.input.len())); true } else { false } ,
80    "发现 高熵数据",
81    30
82);
83
string_analyze/rules/core/other.rs

string_analyze/rules/core/
other.rs
