Add ThingsBoard rule

CHANGELOG.md

@@ -20,6 +20,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
   - Doppler SCIM Token ([#111](https://github.com/praetorian-inc/noseyparker/pull/111))
   - Doppler Audit Token ([#111](https://github.com/praetorian-inc/noseyparker/pull/111))
   - Dropbox Access Token ([#106](https://github.com/praetorian-inc/noseyparker/pull/106))
+  - ThingsBoard Access Token ([#112](https://github.com/praetorian-inc/noseyparker/pull/112))
+  - ThingsBoard Provision Device Key ([#112](https://github.com/praetorian-inc/noseyparker/pull/112))
+  - ThingsBoard Provision Device Secret ([#112](https://github.com/praetorian-inc/noseyparker/pull/112))
   - TrueNAS API Key (WebSocket) ([#110](https://github.com/praetorian-inc/noseyparker/pull/110))
   - TrueNAS API Key (REST API) ([#110](https://github.com/praetorian-inc/noseyparker/pull/110))
   - WireGuard Private Key ([#104](https://github.com/praetorian-inc/noseyparker/pull/104))

README.md

@@ -4,7 +4,7 @@ Nosey Parker is a command-line tool that finds secrets and sensitive information
 
 **Key features:**
 - It supports scanning files, directories, and the entire history of Git repositories
-- It uses regular expression matching with a set of 126 patterns chosen for high signal-to-noise based on experience and feedback from offensive security engagements
+- It uses regular expression matching with a set of 129 patterns chosen for high signal-to-noise based on experience and feedback from offensive security engagements
 - It groups matches together that share the same secret, further emphasizing signal over noise
 - It is fast: it can scan at hundreds of megabytes per second on a single core, and is able to scan 100GB of Linux kernel source history in less than 2 minutes on an older MacBook Pro
 

crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_check_builtins-2.snap

@@ -2,5 +2,5 @@
 source: crates/noseyparker-cli/tests/rules/mod.rs
 expression: stdout
 ---
-126 rules and 3 rulesets: no issues detected
+129 rules and 3 rulesets: no issues detected
 

crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_json-2.snap

@@ -480,6 +480,18 @@ expression: stdout
       "id": "np.telegram.1",
       "name": "Telegram Bot Token"
     },
+    {
+      "id": "np.thingsboard.1",
+      "name": "ThingsBoard Access Token"
+    },
+    {
+      "id": "np.thingsboard.2",
+      "name": "ThingsBoard Provision Device Key"
+    },
+    {
+      "id": "np.thingsboard.3",
+      "name": "ThingsBoard Provision Device Secret"
+    },
     {
       "id": "np.truenas.1",
       "name": "TrueNAS API Key (WebSocket)"
@@ -513,7 +525,7 @@ expression: stdout
     {
       "id": "default",
       "name": "Nosey Parker default rules",
-      "num_rules": 106
+      "num_rules": 109
     },
     {
       "id": "np.assets",

crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_noargs-2.snap

@@ -124,6 +124,9 @@ expression: stdout
  np.stripe.1         Stripe API Key 
  np.stripe.2         Stripe API Test Key 
  np.telegram.1       Telegram Bot Token 
+ np.thingsboard.1    ThingsBoard Access Token 
+ np.thingsboard.2    ThingsBoard Provision Device Key 
+ np.thingsboard.3    ThingsBoard Provision Device Secret 
  np.truenas.1        TrueNAS API Key (WebSocket) 
  np.truenas.2        TrueNAS API Key (REST API) 
  np.twilio.1         Twilio API Key 
@@ -134,7 +137,7 @@ expression: stdout
 
  Ruleset ID   Ruleset Name                         Rules 
 ─────────────────────────────────────────────────────────
- default      Nosey Parker default rules             106 
+ default      Nosey Parker default rules             109 
  np.assets    Nosey Parker asset detection rules      15 
  np.hashes    Nosey Parker password hash rules         5 
 

crates/noseyparker/data/default/builtin/rules/thingsboard.yml

@@ -0,0 +1,64 @@
+rules:
+
+# FIXME: add MQTT rule(s)
+# - https://thingsboard.io/docs/paas/reference/mqtt-api/
+# - https://thingsboard.io/docs/reference/mqtt-api/
+
+# FIXME: 
+# The default access token follows the format [a-z0-9]{20}. However users may replace it with arbitrary tokens, provided they are between 1 and 32 characters in length.
+# TODO: Update the regex pattern accordingly (currently it matches only the default format).
+# After some research it appears that most (if not all) users utilize the default format so this is a low priority issue.
+
+# FIXME:
+# The default provision key/secret follows the format [a-z0-9]{20}. Users can replace it with arbitrary keys/secrets and there seems to be no length restriction.
+# TODO: Update the regex patterns accordingly (currently they match only the default format).
+# After some research it appears that most (if not all) users utilize the default format so this is a low priority issue.
+
+- name: ThingsBoard Access Token
+  id: np.thingsboard.1
+
+  pattern: |
+    (?x)
+    thingsboard\.cloud/api/v1/
+    ([a-z0-9]{20})
+
+  examples:
+  - http://thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
+  - https://thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
+  - coap://coap.thingsboard.cloud/api/v1/354u1g321kcqc1oad3w7/telemetry
+
+  references:
+  - https://thingsboard.io/docs/paas/reference/http-api/
+  - https://thingsboard.io/docs/paas/reference/coap-api/
+
+- name: ThingsBoard Provision Device Key
+  id: np.thingsboard.2
+
+  pattern: |
+    (?x)
+    "provisionDeviceKey"\s*:\s*"
+    ([a-z0-9]{20})
+    "
+
+  examples:
+  - '"{"deviceName": "DEVICE_NAME", "provisionDeviceKey": "s2s1gfcuatgbi61n8h5s", "provisionDeviceSecret": "xbzsovaw9ix4qfhi14an"}"'
+
+  references:
+  - https://thingsboard.io/docs/paas/reference/http-api/
+  - https://thingsboard.io/docs/paas/user-guide/device-provisioning/
+
+- name: ThingsBoard Provision Device Secret
+  id: np.thingsboard.3
+
+  pattern: |
+    (?x)
+    "provisionDeviceSecret"\s*:\s*"
+    ([a-z0-9]{20})
+    "
+
+  examples:
+  - '"{"deviceName": "DEVICE_NAME", "provisionDeviceKey": "s2s1gfcuatgbi61n8h5s", "provisionDeviceSecret": "xbzsovaw9ix4qfhi14an"}"'
+
+  references:
+  - https://thingsboard.io/docs/paas/reference/http-api/
+  - https://thingsboard.io/docs/paas/user-guide/device-provisioning/

crates/noseyparker/data/default/builtin/rulesets/default.yml

@@ -115,6 +115,9 @@ rulesets:
   - np.stripe.1       # Stripe API Key
   - np.stripe.2       # Stripe API Test Key
   - np.telegram.1     # Telegram Bot Token
+  - np.thingsboard.1  # ThingsBoard Access Token
+  - np.thingsboard.2  # ThingsBoard Provision Device Key
+  - np.thingsboard.3  # ThingsBoard Provision Device Secret
   - np.truenas.1      # TrueNAS API Key (WebSocket)
   - np.truenas.2      # TrueNAS API Key (REST API)
   - np.twilio.1       # Twilio API Key