heitt 0.4.2 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09a5102cf903ce6b0064303daa378ba34d5ab5835ec90be737cef63325e48872'
-  data.tar.gz: d6a882c5ae2f4b33390ee4c4a5ca03ffdb3032832333c0a8f355c126a7223841
+  metadata.gz: b4cac48163d051caad98351e1395d1ad624ee01b5bbec6de84e34f85818495f1
+  data.tar.gz: ac8e59ea2f8bcb08307c3b0393a7a482cdea7bb7e47163eefb2ff6e817074d1f
 SHA512:
-  metadata.gz: 0da456e13048b5687e010ccc6361179f51a781d97880d22306a5a90eda9bb48ca5f596f196d4cbee7d0fdb10e58cac24674cc5a15efe366811a81745d6d90f48
-  data.tar.gz: 4c65b51cda918629388e41ecde058909ba475fafcdeb1640b02b0c68609b29bcc804e9b24512de7d67f502a26a6bd0923688d3dec9de274e7ce118df4c5e0a9e
+  metadata.gz: 3c9acfa3fb59aa5e66f40e87651df940609faf644f4272c57ce277996b07b2ed8a0185d4b7b03a93fac98bd16a72ffa8fef2964eebfb75f9e82d5758abd8cd1d
+  data.tar.gz: 7f1e6fcd83c8eedf484816a9caa01c050d10e263455948a51a77dcb28bcd6f75bacbf8f4a2a1f5c02713b9e9f769f8d68ccb48119bd23a562158651b7a6b3b7e

data/bin/heitt

@@ -4,6 +4,7 @@ require 'io/console'
 require 'heitt'
 
 
+
 module HEITT
   class CLI
     attr_accessor :inputs, :extended, :verbose, :output, :json, :database, :show_regex_match, :min_entropy
@@ -151,6 +152,25 @@ module HEITT
         exit(1)
       end
     end
+
+    def decode(text, decoders)
+      #Check if result is printable ascii after decoding
+      decoders.each do |decoder|
+        case decoder
+        when "b64"
+          text = text.gsub(/[A-Za-z0-9+\/]{4,}={0,2}/) do |match|
+            current = match
+            loop do
+              #until word is non printable ascii continue decoding
+              decoded = Base64.decode64(word) #rescue break
+              current = decoded.strip.match?(/\A[[:print:]]+\z/) ? decoded.strip : break
+              #puts "IS PRINTABLE?: #{decoded.match?(/\A[[:print:]]+\z/)}"
+              #puts "RESULT: #{result}"
+            end
+            current
+          end
+        when "hex"
+          text = tesxt.gsub(/)
   end
 end
 

data/lib/heitt/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module HEITT
-  VERSION = "0.4.2"
+  VERSION = "0.4.4"
   GITHUB = "https://github.com/jobotow/heitt"
 end

data/lib/heitt.rb

@@ -69,7 +69,6 @@ module HEITT
           prefix_matched_mode = mode[:name]
           score += 20
         end
-        #puts "MODENAME: #{mode[:name]}"
         {
           name: mode[:name],
           hashcat: mode[:hashcat],
@@ -95,7 +94,7 @@ module HEITT
       entry[:candidates] || entry[:types] || entry[:hashtypes]
     end
 
-    #this  code is a copy or inspiration of "https://github.com/chrisjchandler/entropy/blob/main/entropy.go"
+    #this  code is an inspiration of "https://github.com/chrisjchandler/entropy/blob/main/entropy.go"
     def self.entropy(text)
       frequency = Hash.new(0)
       text.each_char { |ch| frequency[ch] += 1 }
@@ -211,11 +210,22 @@ module HEITT
 
           candidates = HEITT::Analyzer.score_candidates(modes, delim_prefix, context_scores)
           score = candidates.first[:score]
-          if score > (seen[matched] || -1)
-            seen[matched] = score
-            found[matched] = {hash: matched, candidates: candidates}
+
+          found[matched] ||= {hash: matched, candidates: []}
+          found[matched][:candidates].concat(candidates)
           end
         end
+
+          found.each_value do |result|
+           result[:candidates] = result[:candidates]
+            .group_by {|c| c[:name]}
+            .map {|name, dupes| dupes.max_by {|c| c[:score]}}
+            .sort_by {|c| -c[:score]}
+
+            # Re-assign confidence based on final merged scores
+            scores_hash = result[:candidates].map {|c| [c[:name], c[:score]]}.to_h
+            confidences = Analyzer.assign_confidence(scores_hash)
+            result[:candidates] = result[:candidates].map {|c| c.merge(confidence: confidences[c[:name]])}
       end
       found.values
     end
@@ -305,7 +315,7 @@ module HEITT
       JSON.pretty_generate(
         renumbered_groups.map do |group|
           visible_candidates = group[:candidates].select do |c|
-            (!c[:extended] || extended) && (c[:confidence] != "regex-match" || show_regex_match)
+            (!c[:extended] || extended)  && (c[:confidence] != "regex-match" || show_regex_match)
           end
           {
            cluster_id: group[:cluster_id],

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: heitt
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.4
 platform: ruby
 authors:
 - Jonathan Botchway Owusu
@@ -13,14 +13,14 @@ dependencies:
   name: colorize
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.8.1
 description: Hash Extraction, Identification and Triage Tool.