string_analyze/rules/core/
other.rs

1use crate::entropy::entropy;
2use crate::rules::lazy_rule;
3
4lazy_rule!(
5    RE_SET_KEY = r#"(?i)(?:key|token)[a-z0-9_\-\s]{0,15}[=|:][\s]{0,5}(?:"|')?[a-z0-9_\-\.\+\/]{8,256}(?:"|')?"#,
6    "发现 可疑key赋值",
7    50
8);
9
10lazy_rule!(
11    RE_TOR_ONION = r#"\b[a-z2-7]{16,56}\.onion\b"#,
12    "发现 暗网 Onion 链接",
13    50,
14    3.0
15);
16lazy_rule!(
17    RE_URL = r#"(?i)(?:https?|ftp)://(?:localhost|(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}|(?:\d{1,3}\.){3}\d{1,3})(?::\d{1,5})?(?:/[^\s<>\"'{}|\\^`\\]*)?"#,
18    "发现 URL 链接",
19    5
20);
21lazy_rule!(
22    RE_IPV4 = r#"\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b"#,
23    "发现 IPv4 地址",
24    10,
25    ((1, false, r"\."), (1, false, r"\."))
26);
27lazy_rule!(
28    RE_IPV6 = r#"\b(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:\b[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b"#,
29    "发现 IPv6 地址",
30    10,
31    2.0
32);
33lazy_rule!(
34    RE_MAC = r#"\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b"#,
35    "发现 mac 地址",
36    10
37);
38lazy_rule!(
39    RE_CIDR = r#"\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}\b"#,
40    "发现 CIDR",
41    10
42);
43
44lazy_rule!(
45    RE_UUID = r#"(?i)[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"#,
46    "发现 UUID",
47    8
48);
49
50lazy_rule!(
51    RE_UNIX_TIMESTAMP = r#"\b1[0-9]{9,12}\b"#,
52    "UNIX_TIMESTAMP",
53    5
54);
55lazy_rule!(
56    RE_ISO8601_DATETIME = r#"\b\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])[T\s](?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d{1,9})?)?(?:Z|[+-](?:0[0-9]|1[0-4]):?[0-5]\d)?\b"#,
57    "发现 ISO8601 标准时间戳",
58    5
59);
60lazy_rule!(
61    RE_PATH_WIN = r#"(?i)^[a-z]:[/\\](?:[^\\/:*?"<>|\r\n\t]+[/\\])*[^\\/:*?"<>|\r\n\t]+"#,
62    "发现 Windows 绝对路径",
63    1
64);
65lazy_rule!(
66    RE_PATH_UNIX = r#"(?:~|(?:\.\./|\./)|/)[a-zA-Z0-9._-]+(?:/[a-zA-Z0-9._-]+)+"#,
67    "发现 Unix 路径",
68    1,
69    ((8, false, r"(?i)(?:[a-z]:?|https?:/?/?)$"),) // (前断言, 后断言)
70);
71
72lazy_rule!(
73    HIGH_ENTROPY = |s| if s.input.len() <= 512 && entropy(s.input.as_bytes()) >= 5.9 {
74        s.ranges.push((0, s.input.len()));
75        true
76    } else {
77        false
78    },
79    "发现 高熵数据",
80    30
81);
string_analyze/rules/core/other.rs

string_analyze/rules/core/
other.rs
