"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord VarysWhispers is a static code analysis (https://www.kitploit.com/search/label/Static%20Code%20Analysis) tool designed for parsing various common data formats in search of hardcoded credentials (https://www.kitploit.com/search/label/Hardcoded%20Credentials) and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline.
Detects
PasswordsAPI tokensAWS keysPrivate keysHashed credentialsAuthentication tokensDangerous functionsSensitive files
Supported Formats
Whispers is intended to be a structured text parser, not a code parser.The following commonly used formats are currently supported:YAMLJSONXML.npmrc.pypirc.htpasswd.propertiespip.confconf / iniDockerfileDockercfgShell scriptsPython3Python3 files are parsed as ASTs because of native language support.
Declaration & Assignment Formats
The following language files are parsed as text, and checked for common variable declaration and assignment patterns:JavaScriptJavaGoPHP
Special Formats
AWS credentials (https://www.kitploit.com/search/label/Credentials) filesJDBC connection stringsJenkins config filesSpringFramework Beans config filesJava Properties filesDockercfg private registry auth filesGithub tokens
Installation

From PyPI
pip3 install whispers

From GitHub
git clone https://github.com/Skyscanner/whispers
cd whispers
make install

Usage

CLI
whispers --help
whispers --info
whispers source/code/fileOrDir
whispers --config config.yml source/code/fileOrDir
whispers --output /tmp/secrets.yml source/code/fileOrDir
whispers --rules aws-id,aws-secret source/code/fileOrDir
whispers --severity BLOCKER,CRITICAL source/code/fileOrDir
whispers --exitcode 7 source/code/fileOrDir

Python
from whispers.cli import parse_args
from whispers.core import run

src = "tests/fixtures"
configfile = "whispers/config.yml"
args = parse_args(["-c", configfile, src])
for secret in run(args):
print(secret)
Config
There are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions (https://www.kitploit.com/search/label/Regular%20Expressions) and several other parameters. There is a default configuration file built-in that will be used if you don't provide a custom one.config.yml should have the following structure:include:
files:
- "**/*.yml"

exclude:
files:
- "**/test/**/*"
- "**/tests/**/*"
keys:
- ^foo
values:
- bar$

rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: TrueThe fastest way to tweak detection (ie: remove false positives and unwanted results) is to copy the default config.yml (https://github.com/Skyscanner/whispers/blob/master/whispers/config.yml) into a new file, adapt it, and pass it as an argument to Whispers.whispers --config config.yml --rules starks src/file/or/dir
Custom Rules
Rules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.Custom rules can be defined in the main config file under rules:Custom rules can be added to whispers/rules (https://github.com/Skyscanner/whispers/blob/master/whispers/rules)rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO

key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching

value: # specify value format
regex: ^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$
ignorecase: False # case-sensitive matching

___________________________
@hacking_Attack
@Hacking_Video

minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI

similar: 0.35 # maximum allowed similarity between key and value
# (1.0 being exactly the same)
Plugins
All parsing functionality is implemented via plugins. Each plugin implements a class with the pairs() method that runs through files and returns the key-value pairs to be checked with rules.class PluginName:
def pairs(self, file):
yield "key", "value"

Download Whispers (https://github.com/Skyscanner/whispers)

___________________________
@hacking_Attack
@Hacking_Video

Is there more money in mobile application pentesting?
https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/

submitted by /u/Solid_Secret594 (https://www.reddit.com/user/Solid_Secret594)
[link] (https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/) [comments] (https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/)

___________________________
@hacking_Attack
@Hacking_Video

Nmap nedir?Nasıl kullanılır?
https://mirabbasagalarov.medium.com/nmap-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-9fb43e9a5e09?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Nmap nedir?Continue reading on Medium » (https://mirabbasagalarov.medium.com/nmap-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-9fb43e9a5e09?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Whispers - Identify Hardcoded Secrets In Static Structured Text

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Holiday Scams Drive SMS Phishing Attacks

Attackers typically target consumers with malicious text messages containing obfuscated links, but experts say businesses are threatened as well.

Dark Reading: Attacks/Breaches
Apple Sues NSO Group for Spyware Use

The company seeks to hold Israeli firm NSO Group liable for the targeting of Apple users and requests a permanent injunction to ban its use of Apple products and services.

Hacking on Medium
Computer Hacking Began with a Cereal Box Toy

https://cdn-images-1.medium.com/max/600/1*kHd3lcqlCuT-yiwjYSMF6w.jpeg
How People Exploited The Network Before The Network

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is nmap?

প্রোগ্রামটি সাধারণত কমান্ড-লাইন ইন্টারফেসের মাধ্যমে ব্যবহৃত হয় (যদিও জিইউআই ফ্রন্ট-এন্ডগুলিও উপলব্ধ) এবং লিনাক্স, ফ্রি বিএসডি এবং জেন্টু…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Take care of the security of your data! How easy it is to eavesdrop on a Wi-Fi transmission

https://cdn-images-1.medium.com/max/681/1*i8NQViScV5iiKdv92SRLCg.png
Cybersecurity is the most crucial thing nowadays, but sometimes we are not aware of how easy it is to still our data from unsecured wifi.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Find reflected XSS candidates in source code

https://cdn-images-1.medium.com/max/758/1*WIi0_jYkCVBZHxEOEJOLzw.png
Using Ocular to search for reflected XSS in an application

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video