Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Datadog API Key matches incorrectly #231

Closed
SkeletalDemise opened this issue Nov 9, 2021 · 0 comments
Closed

Datadog API Key matches incorrectly #231

SkeletalDemise opened this issue Nov 9, 2021 · 0 comments
Labels
good first issue Good for newcomers Regex issue Regex is not full or matches a lot of false positives

Comments

@SkeletalDemise
Copy link
Contributor

$ poetry run pywhat "b8cedc00407a4c56a3bda1ed605c6fc1"
Matched on: b8cedc00407a4c56a3bda1ed605c6fc1
Name: Datadog API Key
Exploit: Use the command below to verify that the API key is valid:
  $ curl -X GET https://api.datadoghq.com/api/v1/validate -H "Content-Type: application/json" -H "DD-API-KEY:
b8cedc00407a4c56a3bda1ed605c6fc1"

It's too broad and matches on any 32 character hexadecimal string. If it can't be less broad then lower the rarity to 0. This is the regex it uses: ^([a-f0-9]{32})$

@ghost ghost added good first issue Good for newcomers Regex issue Regex is not full or matches a lot of false positives labels Nov 9, 2021
nodtem66 added a commit to nodtem66/pyWhat that referenced this issue Dec 1, 2021
- change the rarity of Datadog Client Key to 0.3
- remove `"Description"` of all Datadog RegExp
@ghost ghost closed this as completed in cc2a8a2 Dec 2, 2021
ghost pushed a commit that referenced this issue Dec 2, 2021
This issue was closed.
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
good first issue Good for newcomers Regex issue Regex is not full or matches a lot of false positives
Projects
None yet
Development

No branches or pull requests

1 participant