Merge pull request #199 from blacklanternsecurity/yii2

Yii2 module addition

Author: liquidsec

README.md

@@ -36,6 +36,7 @@ Inspired by [Blacklist3r](https://github.com/NotSoSecure/Blacklist3r), with a de
 | Laravel_SignedCookies | Checks 'laravel_session' cookies for known laravel 'APP_KEY' |
 | ASPNET_Vstate      | Checks for a once popular custom compressed Viewstate [code snippet](https://blog.sorcery.ie/posts/higherlogic_rce/) vulnerable to RCE|
 | Rack2_SignedCookies | Checks Rack 2.x signed cookies for known secret keys |
+| Yii2_SignedCookies | Checks Yii2 framework's cookie validation keys for known secrets |
 
 ## Installation
 
@@ -282,6 +283,7 @@ Express_SignedCookies_CS = modules_loaded["express_signedcookies_cs"]
 Laravel_SignedCookies = modules_loaded["laravel_signedcookies"]
 ASPNET_Vstate = modules_loaded["aspnet_vstate"]
 Rack2_SignedCookies = modules_loaded["rack2_signedcookies"]
+Yii2_SignedCookies = modules_loaded["yii2_signedcookies"]
 
 
 x = ASPNET_Viewstate()
@@ -409,6 +411,14 @@ if r:
 else:
     print("KEY NOT FOUND :(")
 
+x = Yii2_SignedCookies()
+print(f"###{str(x.__class__.__name__)}###")
+r = x.check_secret("0bb72f36d041a3a022f231eebe114889ee442092ee350242ffb2d4bb53887a81a%3A2%3A%7Bi%3A0%3Bs%3A4%3A%22lang%22%3Bi%3A1%3Bs%3A7%3A%22English%22%3B%7D")
+if r:
+    print(r)
+else:
+    print("KEY NOT FOUND :(")
+
 ```
 
 #### Carve

badsecrets/base.py

@@ -112,6 +112,7 @@ def carve(self, body=None, cookies=None, headers=None, requests_response=None, *
 
         if headers:
             for header_value in headers.values():
+
                 # Check if we have a match outright
                 r = self.check_secret(header_value)
                 if r:

badsecrets/modules/yii2_signedcookies.py

@@ -0,0 +1,48 @@
+# flask_secret_keys wordlist shamelessly copied from https://github.com/Paradoxis/Flask-Unsign <3 <3 <3
+
+import re
+from badsecrets.base import BadsecretsBase
+import hmac
+from hashlib import sha256
+from urllib.parse import unquote
+
+
+class Yii2_SignedCookies(BadsecretsBase):
+    # Match 64 hex chars (SHA256) followed by PHP serialized data
+    identify_regex = re.compile(r"^[a-fA-F0-9]{64}a%3A[a-zA-Z0-9%]+$")
+    description = {"product": "Yii2 Signed Cookie", "secret": "Yii2 cookieValidationKey", "severity": "HIGH"}
+
+    def verify_yii2_cookie(self, cookie_value, validation_key):
+
+        # URL decode the whole value first
+        decoded_cookie = unquote(cookie_value)
+
+        # Split decoded value into signature and data
+        signature = decoded_cookie[:64]
+        data = decoded_cookie[64:].encode("utf-8")
+
+        # Calculate HMAC-SHA256 using raw key
+        mac = hmac.new(validation_key.encode("utf-8"), data, sha256)
+        expected_signature = mac.hexdigest()
+        return signature.lower() == expected_signature.lower()
+
+    def check_secret(self, yii2_cookie):
+        if not self.identify(yii2_cookie):
+            return None
+
+        for password in set(self.load_resources(["yii2_cookieValidationKeys.txt", "top_100000_passwords.txt"])):
+            password = password.rstrip()
+            if self.verify_yii2_cookie(yii2_cookie, password):
+                return {"secret": password, "details": "Valid cookieValidationKey found"}
+
+    def get_hashcat_commands(self, yii2_cookie, *args):
+        return [
+            {
+                "command": f"hashcat -m 19700 -a 0 {yii2_cookie} <dictionary_file>",
+                "description": "Yii2 Cookie Validation Key",
+                "severity": "HIGH",
+            }
+        ]
+
+    def carve_regex(self):
+        return re.compile(r"[^=]+=([a-fA-F0-9]{64}a%3A[^;]+)")

badsecrets/resources/yii2_cookieValidationKeys.txt

@@ -0,0 +1,301 @@
+".$cookieValidationKey."
+%^&*()JH(**)H(JKLG&*(R%^(UJ()J()
+-3ffDUN7EtLddlOgyHFznuS64pR0a78Q
+-3o4E8YUQjnojIBI0ZWMA30eI1bxh5IQ
+-ab05p9ooDOXSQG4VENCQvupiYwBMOII
+-CHMxJ69ZZORr_aErVh0b4GnjCVrHQHc
+-gZ6AoxklSu1iy2mYvzmrS9NHFwEJsPV
+-sqOI0mlTYB8d2qDwkdnu-UudBJQaNwz
+-wvnuadHgBIriDedQwaDz25FmGsxTL6O
+08d8b299f21c4dd0b81190972e9233d9
+0_0w-naFBuT9NGxrkABFtAszJiouNl8s
+0e5N415WTrIrcawM0vr4jineqKu7vzMx
+0iOrv5YCnSBY2wAdt9z-8EK6nwuCPh2g
+0Oh6j_0eKyKJ0d7bBsebS2QDPmsgZojk
+0paU95BJBjgc8F00sz4JLZkn53I8MRTN
+0QXciSd-hoCDCTd3bIGbNUlZzDOMTmpG
+0wk1ayKHWC44MTmnYulIAT6c3MVUp2L1
+0zlT5PU0aDhO5wuxfnOvilJCh4CNUXFu
+1-mDz2sD92g-DpVK5NiLPb7QdYq_tHHh
+11g-ICtiMpVx7WGB3SfQtUI56LVp9H09
+1223456789
+123
+12345678
+1348860441
+1431414123190090990909
+17O9JuhpSBcH4qYWnZrDS62NAYu7oAo1
+1AKJyFLbfV50WohdwMuqpzwak9wH01T7
+1D63Jwe1hiUtFH815xIi0Ixvuh6EqDwZ
+2821868438
+29234500
+2923534000
+2yzRNcm-CKfWteL1xqrBMDCfqud2u5eU
+38838938936689
+45ed697dtg8uhrg9eheg00j09
+4hfR3NhwFDMJxrcchu_APBgTwrFSxXt-
+4pZArirHMMzFjs2fP53IGsaF8bX82uEK
+4V3hcVkYyPlfapn36JCGXUjzAzDyJhsy
+66c957a65f4dfc0e6c2699f692ff17cd
+6VehvOH_JIkJ7JymtY0Oel-dSUzzLRT7
+6WIDi8V6ZoQYzJCfH8wgkO2nS_YQZOo-
+6XZr8wRMUzI4hzSY5ynIj9da-aTpmT-l
+6ZoDxNQWJLagz3dhQzchvQ1966rRhudE
+7dkNyUW7ZqFWTT6IPiAYb6G2W3waiZ3X
+7X0dtpvktsnbr3h2XhFKs7Asl7qagW3g
+8soUA1VwjXbWEfzBEyD4K-1aeI2SutCV
+91pFOhUmhJcKvasyPQZI-cOuiwrI_M-Y
+9te1HJt3rRCqy9bQvMN2Ly5Z9f6t1Ouv
+9uv54-uvETwGqEWbK-9qq9hjRiLISSdw
+<?=isset($cookieValidationKey)?$cookieValidationKey:
+<secret random string goes here>
+@l#!/*W&+e5U-a%3IJnkC3|&nj^jpB#2.J2P
+[CSRF Key]
+[RANDOM KEY HERE]
+\<random string nice n long>
+_3VGWOfq8uWRZA-8ZEwF2UmNaPAloJjT
+_KrWQvmDJum_stF3vIO3MgXIyKn-rX28
+_pgCqvUirbYul8SQgXwSvms94dRKcEIX
+abcdefghijklmnopqrstuvwxyz012345
+alsdaf8*D(as8dasj
+ameBP_kz5IJ5-5mtQwp7lv2qj_1hDU9N
+api.application.www.b5net.com
+asd
+asdasAsadcSffgrd21aPleAerbhH
+asdasdsadadadada
+asdfsdfsdfs
+asdSb6orgFTiVXS05DS6TFqqLJQjf6ad
+asfsfdfdsfsd
+B5clhW-qqZndTv4tssQUE1WwDqrX3Bfo
+BCUm2SFBIThfY_CLwQaunfOFWPQwabp9
+bdgsddshfdbvgas14tds53tewu754edfv
+beNS_ukv8q7lGuGci0WrOg7Uy0qilYE_
+BjQnCuPZWKbjqV_HlQcgPuhuys3ihMKx
+bov4zECSN9LVaedRYS-xb5mxsnMNFqWI
+BqQTsu720MUOpioFJpJQVVyqS47PjjR8
+bWDbz9vyy-2hhGXg5oNHplSRZF-UD_Ij
+BYsZYK6GVFucxYv4cBuHD73Q8mRi5ZGD
+c3KxaQtedXAsvrUkULoiSDJ2gYPnidXf
+carsinsuranceindia
+chaide123
+cHsaFfPdkzswmgiXpZ2X_aLk8coW2fik
+citibus
+cMr2rLVvljIhN-CjvZi206hyFW7xZTdD
+CNsW2fQRoOgyYWSkFDY1uDfxpiPvbC01
+cookieValidationKey
+crouns
+CTNrckVh0Bwz2SVQUXEYkhbt0bxm1MoZ
+D6zCxJSFlWMPLSSAJKYwRY5CbrvBF7AJ
+dBjBzMTsoFsUtpIF4GAaAqtGVC3hjCfo
+DeuV44Ygufd363hHwV8uMZJSJyT9KXj4
+development
+dfg5y0dg-45sdg1v_dfg2rgh-ssWe0q
+DRvFtSLNf46sEEu7bbG9sj267a4XJlUq
+DuG6WXyJfk73xhCh8s3DdNr1uOn7GGM-
+DYuNUtMPNM3cFbeUbEY4m9Gu-qzALDHH
+eb9DFxpAUINo1bDhSyxLHnToTyUdtxlV
+Eg9MR1TYGf7PFT7-As63pT2GnVTXRbQS
+EJBy8WRohzpqJY7BTurjQaft2NV-g1cA
+enter your secret key here
+eSDNQqclPQoW1Zhkm6guPKQuVuMCIOJd
+f0J4-TdSBFyMpAXH3opRwQAGdDMGgtUt
+f763603732269fb75965b4a470455cf16b045326
+f9QDGuKYKutFihiE-1TRkqxJKmmY7N0q
+fCW-lf4bgT6kl7AX7q1_Z8nrB79T_cL0
+Fet2SHWdQQCJgh9dFkbF2RksZkU-pDOr
+fill in a secret key here
+Fssdf12d2s31raararararf2asdaZTq4GhB2W2QZqyierWmHWmFwAK
+Fxd2lkEPXhjmuPXi4ECR1M12HnnEq_kU
+gB_-zECp2elHU6gHSFAZc2pVozYEhEp8
+geetasksecret
+gfiLiZYgM8i39whlNHkOEow2TC6R0rXw
+ghsj&s_5{g#
+gn-9Ux0lv7wT4VcdfXvOTTQWveFQE2FP
+go9F70D1NY-VTtHV8GZU4EPV5F9snCbZ
+Gp9OXN6nMnp--YxgCYbNt6W9xew4k_By
+Gtwerwe34dvh90FArwre
+Gv0nHTwegb0Fa6bnWUUZOvxiqv10n03J
+H9faj5kCQM
+HAOcBYal0wqXg1kBwPZs5wStyqwQv_d4
+hC0PCZY3a5vLBxsCvfrvbwpQ7fZeez_o
+hh4tEcWT0KKLw$@157dKiUg7x~0Ad2*7d91#FJm1zb#9QCabq}hj}F7{57t2U8S#
+HjorQDlOMQXDRWcElFmX5iuVPfV1Pe9j
+hUqDYrJhdCFc6Qr6ppmXgSs8vTpKTLmc
+HVZrcUWNy4g1W_1yHDzNL4S09ScbhjDt
+hwdn8-iyIh5LylPLpD1PoplqjUka98Ba
+I-love-Yii2
+I2zaS-tiy069Mi6geizcZ3iAcA75GC2B
+I9twgjl1VHz2jm0Lh8XHd2AANJRq4RtH
+IeycYPYcVgCYNubf3oBvDJiBgivKMFoD
+IgAv5_z9pAJYj5XifBP5qHbABhGth_h4
+ihub
+iNgPOK8X4qFxJGxM7sDgXtQL1tnQNwJA
+iniadalahsecretkeyuntukcookie
+iQBKaQuqISOxZ84VO_EjqSINmUX51e1w
+iteazytest
+j5RVvxZIJQmqTlGpFzihajszp2gVuANO
+JDqkJaMgIITAKcsJY6yvLQdM9jf7WghX
+JH9hGZzjyaGctN8R_pfYArr_ZFgkIPv7
+jJqAbn3Mr0Cwx8VM_XaWnjDgdquq_vrr
+Jlwdg1TXsNyKBNypaXXl08_jXDEpPUVT
+JybFpZXMaQNoT9f0197C7xog0F4-NCqL
+Jylm1ld7qwzDt2nySXPFRSXsRvD3_cRu
+KaNMPF6oZegCr0bhED4JHYnhOse7UhrS
+KAwHQH1k3srx7iGs5Tg2L1bhdZ_nRjI-
+KBcetJwcWd5dIE1Z2BBjLx1pzxHwa6jy
+KCH-ljQL1txZIMEusHZgN8ECZs6GHHKD
+key
+KFBI6reenOjMCowgwXJCMlZGktelMYA7SyMexUGdyditoGber7siso
+ki4CcUDzXK3YJzm5X3jw-0Yiiwb5OsZN
+KMH2fE7EsGUMysHFAjxEcURe_q5rda59
+KS-GsRZNI5wnzWXgVc2dmQPqHvjg7dKd
+ksZ0900X9nvMMMyw37kRUILnrjltI7rj
+kt4gok1H6ISgQe1NlG0g92m9_RkYMgpo
+kZNDjIFgF1DJAZOTBW4umD4_WP2itjiw
+l63RbVH4rZYfXNn6JGWq88D41dc8cK00
+laeti
+LcFnSegZicgJpzBTArE6Qgjnf8nfHM6S
+letyii@!$(!&@
+Lf1hcz2i6_tj2d-i3-3ISd3B55_QKy71
+Lft6gEP2QuiCKdTInd7z0lhz__coAYCj
+LPNw88N93goOVcqVfJZb7yMZZRis_tTV
+lqNCkvEXt__5jLmIkUk6AUnRLj4K_qk8
+LrxOKUC-zXdQ40iBoXQWu3sljHRhbNXZ
+LyWC3tf2Bi8wUT6iJtdsgfIaZtc6CddY
+M-SQu6u6d-V5YinHtgifL6x2k1J6BwBb
+M0WYPF4CqWbMjHhucjMyqrf25xjNAk4j
+M48085L3F3Oy7cV4U01mWd1We7OtSiiG
+MDxAFCVHh8dfRfkSLtVDcjUCOIYa0CXV
+MeHYbcMs-njKgb2wDNXcZ-q7pI0xcy2o
+MERe0aSPDBmwt_3An7yqK6Y3VRnSEEKW
+mldcOhzqWMRgnEnGwqMKxIaiUJHiL_te
+mMSEH2PKbKevInuOsNvXh9_oPtNSC2et
+moon
+MsTEwas232
+mtAsnDCTuuZoahYt1ER838WsACPcmlV3
+Mx3-M-iXODDptssVYApG8WbGG9M4Dp5Q
+mySecretKey
+Nhập secret key tuỳ chọn vào đây
+NsB1f_FXBfgYOP1M1ErfscN-Kip98P6G
+nsFLiKiW5Kxk9xkeW85w4XYPICHU0J-Z
+nttN49BkYzUIiCrceNFctxIWK33-uLAF
+NXpMoQbj9pEXuBkd79DZJwptmv4biEQg
+O1d232trde1x-M97_7QvwPo-5QGdkLMp#@#@
+o1gTz_Q1NiFSctJ99SSYm56VdiTk8HKw
+oFwVN8ObxBLlQyJYGOp_go9EdyIgIY27
+OGCFiHwDQha84eYi8ajfsMJ8XEQ5ft4E
+OhLi2g92xO0Fj1r73_XIrO_60-F2xEdW
+ONIU4--N_7FIwD_-Y5OHWblw8dqU0PyB
+oXKrbycTet8CtdIWBW115vdNBOlphtjs
+oxTxC600X5DGRubG2mYdBMmC4MM0C-ZB
+pablo
+Pd8EdT0AfKjYucnwbnkjamdDJuzVHwxU
+PEi6ICsok3vWiJSJJtQV2JZ6D-jk5gkh
+pepe
+PFOqfTLbN9Nm03ChLMYmX5HGyXoTX7hA
+PvFIRI8b_yld0U496W_zjuCmwjDd6ism
+PXNfaJUXn3HwxUzNw-vONeHlJgVyxOQs
+q0ZHIeAhCBQb8s_8diYJvmC36OTA2QrG
+qbqVJnqfpI6YfTzPUdPL72mhYKRh74up
+QcLDLiX6AhSrCGBVGRi-HQIaPZ78gL6c
+Qh6AkAbY4alGAFda7k0FxE5zApCOlYF-
+Qq0fIK5vB6mseTKoYXX-dVdwHQFYrEXC
+qrbB052lggAyJEJCHd6HQuMTi8ilS4ps
+QTlcIizdBBGYyOLam2YuDWHKMhwAgSsB
+qwe
+qxOH-LMMrJJ_unqJzWsPO1eL39JF0cnK
+RADYvs43eCDoO5GLTEGXSs7GV0W_yDoU
+RAqSIDCpvJwUcmEAeuf7G0u5eT7rnLjr
+rg34123214
+rhANM0cj3sFb2Sy_0CHMNw-tsBf_vVyP
+RhLqcR79Fcg9GUBYSQa9R9BzTfo7htK-
+root
+RPGnD8bw1SmWBLQlv1XmZNvQ1BWx29z5
+RUR9jntbs4hk00D6Q-vf3nch3RdP9fai
+Rv43guZ-Gc791Yj_KpLgUen5O5Fmxs-I
+rVfcjiFtkMxVOsgsPhEI
+RYU8Zk8a6qn5N1bZvUaX3TM6LnRBnHpL
+S12Jkv6jtjLCCnqJKWLUfZ4QWXOFUb4J
+sBL6-t06ztw1QVjToSSvjrS_kc52b-fq
+schoolphone
+sdfjjksloeedf78789judd
+sdi8s#fnj98jwiqiw;qfh!fjgh0d8f
+sdifdbfshbsnstyrfedwety,mnbvcdsfe
+sdNsa23Ms
+secret
+SeNDCi8XHJrBSTZpujKp5D2xWtApuqej
+sewa_assessment
+sipedes123
+SjI1hMMp4bpIgU4_Tdke3W93EhpFghId
+sK8lASIoVVSFDKKRQ1LbN-jwlKjddGD2
+SlItZHuBitQn964GzOijvDz8AdkZgTlT
+SN4W4e4whReWuIJlSP4arZx-pfuTWpvy
+SNfuzgcfPdlc2LPHDbceW0qParv0YPk5
+some_pullr_key
+someValidationKey
+SVnVkT24CuHMpvpvZkiANzL6jR8xSNb0
+SYkjYFnYjkZgkNwhsvW7nU2Yb3X02SOF
+T-jnbpRXnB8GEesBosdfvcPvuqUtYQ5b
+test
+testkey
+TKe-3Bg1VWNFuy6MP0Z51ZF4nm6qoucR
+tmC8OAkIX2onr1DLBAF4IYtAL41Q_eEA
+token
+TRk9G1La5kvLFwqMEQTp6PmC1NHdjtkq
+TRss315QwFJIhelIv7Gnz1d5IDAlRPHX
+Tvs1WyzYBkqUs4nVKWdQ-Xp69NuszsRT
+TZ
+U-l3ZA7DXdK-2liZEZf-hy7PPQV91Cm3
+ubpqVTyRsPjbIHry6aSKZD10LLN9Zw9H
+uhU6aGtOWy7gDIm9AY3cawMuAAlrO8wp
+ujikomirsyad
+UML3Yaqcwpz-qs6C-GyC1Kz1oMRvMzGc
+UNIQUE_KEY_BACKEND
+UNIQUE_KEY_FRONTEND
+Uy4rVP6QGnQimM_S9avA2QZ0bwZiiYXI
+UZyP0w5IDbB3WQMCK8dnXLs8dziwrSs7
+Va1MpFBmItGc9uV6y2STcb-XHw0m0XPD
+VsmVgVFDUWvxnX-vGG5gvLYHJjrgUkn2
+vWLtvK9yeqtdvvEfP1l4snt8VEikNYEQ
+wefJDF8sfdsfSDefwqdxj9oq
+WEsRl7srQajvaDqry_TOmGbcgW08l-KP
+wg1VD6Hul8GQbNLD8PEYr7L2N67EYUnj
+wkHCswIPwLHSEEHaiN4P2nFCu6LDhKfX
+WMnTOZfa_D2CoMZj-U1WY11EwcNYETxg
+Wq72wxi1h7AJ42_DfoId8jSSSFWoUuL8
+wQrzC9luLQMCO1t5RDBEXU5HLQ9LWb0W
+WSw7dEwFY4jKDpb4tFlMSjT3g3351R0L
+wuqKYJyFRLfhuFbepB2aDTFiY30ZQ4X1
+WWAH9LZfwzvV4R-1RoZybEHJTagZa7KT
+X43fRCIn0tHvbWg0LXr8pD-TA_1iQKnH
+xHh6LpjrE6lnVB0E_Gipxai2dkvu_AKb
+XknlLjiyF9IbRBCXlAGxOGQ7CMqVudIf
+XLVFEHM1hG6t52DMKUeBUJkVDDDXigN0
+XS4TmK6AT3poEQ2NgGJij5zSPVsilCvs
+XsvslbQm64aqv_7yX9OASWzXTTlc75Ge
+xWZ35QUMzAprRApQdNFjcHkc87gwHhZV
+xxxx
+xxxxx......
+xxxxxxxx
+xyz
+Y0Sn7Ktyyk0l60_9yJiBkJfZ14Jqw_DeaA5pjNtPE4EuM-qvzietJ0a9OIT63dio4pW98ymEnLEhWAC0oyx55g==
+Y5CGAiG4SQeH5f7gtwoBP4_0leybu6Mp
+y66p--lh5kuVhVbWG8Na0UD6tTK2toqP
+Y8ifrez6YY1-r8Vo3Mv-rM_SFQAn_U5q
+YEagPq8_23qKZ3MIt1WgINQwqD3-HTwn
+yfyjsz
+yhHIxC8wBku2KRsFiTJWMkyz9DCMjr3d
+yii2belajar
+your secret key here
+your-validation-key
+your_validation_key
+YourProjectNameIdKEY
+yqCwgKwBKx9tmybEwgnH-GIplIuOJe8L
+Z7DybJgp8OLtbRXTJOYr3buTl1pIaQeG
+ziH_S4VhNJGkfb9h2wblvWjQTPwaQT9a
+zqv0r-fVImc4m9j1MEkmI-UIswX53tXG
+zR_vg9BEChcN34mow7RmJHToH_xeKFKt
+zvMfIt-ga4Y9vNmh2C-NjShC2N5_zMQd
+ZxlalSjI5PmXh7F02cQeGT17GYbOAQ_L
+{{secret}}
+在此处输入你的密钥
+秘密キーをここに入力