@dxworks/insider 2.9.1

package/insider/config/rules/cryptography/extended.json

@@ -0,0 +1,220 @@
+[
+  {
+    "name": "Cryptography: Encryption (General)",
+    "id": "AI007900",
+    "description": "Detect use of cryptography",
+    "recommendation": "",
+    "applies_to": [
+      "csharp",
+      "vb"
+    ],
+    "tags":[ "Cryptography.Encryption.General" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "AsnEncodedData",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "Cng(Algorithm|Key|Property|Provider|UIPolicy)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CspKeyContainerInfo",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CspParameters",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "DataProtector",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "DeriveBytes",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "e.g. Rfc2898DeriveBytes"
+      },
+      {
+        "pattern": "KeySizes",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "MaskGenerationMethod",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "Oid",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "OidCollection",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "OidEnumerator",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "ProtectedMemory",
+        "type": "regex",
+        "scopes": [ "code" ]
+      },
+      {
+        "pattern": "RIPEMD160",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CngProperty|CngExportPolicies|CngKey|CngUI|CndProvider",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "DataProtectionScope",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "ECKeyXmlFormat",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "MemoryProtectionScope",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "OidGroup",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "KeyAgreeKeyChoice",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "AlgorithmIdentifier",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CmsRecipient",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CmsSigner",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "EnvelopedCms",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "KeyAgreeRecipientInfo|KeyTransRecipientInfo",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "X500DistinguishedName",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "OpenFlags",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "KeyInfo",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "TransformChain",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "XmlDsig",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "XmlLicenseTransform",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "IRelDecryptor",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "ProtectionLevel.None",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "ProtectionLevel.Sign",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "TsCertCompareCertContext",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/insider/config/rules/cryptography/external_libraries.json

@@ -0,0 +1,141 @@
+[
+  {
+    "name": "Cryptographic Library: BouncyCastle",
+    "id": "AI008000",
+    "description": "Cryptographic Library: BouncyCastle",
+    "applies_to": [
+      "csharp",
+      "java",
+      "kotlin",
+      "scala"
+    ],
+    "tags":[ "Cryptography.Library.TLS.BouncyCastle" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "bouncycastle|spongycastle",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptographic Library: mbed TLS",
+    "id": "AI008100",
+    "description": "Cryptographic Library: mbed TLS",
+    "applies_to": [
+    ],
+    "tags":[ "Cryptography.Library.TLS.mbedTLS" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "mbedtls",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptographic Library: OpenSSL",
+    "id": "AI008200",
+    "description": "Cryptographic Library: OpenSSL",
+    "applies_to": [
+    ],
+    "tags":[ "Cryptography.Library.TLS.OpenSSL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "openssl|SSL_CTX_new",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptographic Library: BoringSSL",
+    "id": "AI008300",
+    "description": "Cryptographic Library: BoringSSL",
+    "applies_to": [
+    ],
+    "tags":[ "Cryptography.Library.TLS.BoringSSL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "boringssl",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptographic Library: LibreSSL",
+    "id": "AI008400",
+    "description": "Cryptographic Library: LibreSSL",
+    "applies_to": [
+    ],
+    "tags":[ "Cryptography.Library.TLS.LibreSSL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "libressl",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptographic Library: Win32",
+    "id": "AI008500",
+    "description": "Cryptographic Library: Win32",
+    "applies_to": [
+    ],
+    "tags":[ "Cryptography.Library.Win32" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\b(wincrypt|cryptxml|wintrust|dpapi|bcrypt|cryptdlg|ncrypt|cryptxml|ncryptprotect)\\.h",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptographic Library: .NET",
+    "id": "AI008600",
+    "description": "Cryptographic Library: .NET",
+    "applies_to": [
+      "c",
+      "cpp",
+      "csharp"
+    ],
+    "tags":[ "Cryptography.Library.Microsoft.NET" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "ProtectedData",
+        "type": "string",
+        "scopes": [ "code" ],
+        "_comment": "crypto class"
+      },
+      {
+        "pattern": "DPAPI",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modified": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/insider/config/rules/cryptography/hash_algorithm.json

@@ -0,0 +1,98 @@
+[
+  {
+    "name": "Cryptography: Hash Algorithm (SHA-256)",
+    "id": "AI008700",
+    "description": "Cryptography: Hash Algorithm Usage (SHA-256)",
+    "tags":[ "Cryptography.HashAlgorithm.SHA2" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "SHA-?(2|224|256|384|512)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Hash Algorithm (Legacy)",
+    "id": "AI008800",
+    "description": "Cryptography: Hash Algorithm (Legacy)",
+    "tags":[ "Cryptography.HashAlgorithm.Legacy" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "MD2|MD4|MD5|SHA-?(0|1)",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Hash Algorithm (SHA-3)",
+    "id": "AI008900",
+    "description": "Cryptography: Hash Algorithm Usage (SHA-3)",
+    "tags":[ "Cryptography.HashAlgorithm.SHA3" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "SHA-?3|Keccak",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Hash Algorithm (Misc)",
+    "id": "AI009000",
+    "description": "Cryptography: Hash Algorithm (Misc)",
+    "tags":[ "Cryptography.HashAlgorithm.Misc" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RIPEMD|Blowfish|Twofish|Threefish|Serpent|HMAC|KeyedHashAlgorithm|Blake2|Blake3",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Hash Algorithm",
+    "id": "AI009100",
+    "description": "Cryptography: Hash Algorithm Usage",
+    "tags":[ "Cryptography.HashAlgorithm.Other" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "HashAlgorithm|MessageDigest|DigestUtils",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Hash Algorithm (General)",
+    "id": "AI009200",
+    "description": "Cryptography: Hash Algorithm (General)",
+    "tags":[ "Cryptography.HashAlgorithm.General" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "hash",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "low"
+      }
+    ]
+  }
+]

package/insider/config/rules/cryptography/key_derivation.json

@@ -0,0 +1,65 @@
+[
+  {
+    "name": "Cryptography: Key Derivation",
+    "id": "AI009300",
+    "description": "Cryptography: Key Derivation",
+    "applies_to": ["csharp"],
+    "tags":[ "Cryptography.KeyDerivation.General" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "KeyDerivationAlgorithmNames|SampleDeriveKeyMaterialPbkdf|RNGCryptoServiceProvider|Rfc2898DeriveBytes|KeyDerivation|DeriveKey|PasswordDeriveBytes",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Key Derivation (PBKDF1)",
+    "id": "AI009400",
+    "description": "Cryptography: Key Derivation (PBKDF1)",
+    "tags": [
+      "Cryptography.KeyDerivation.PBKDF1",
+      "Cryptography.HashAlgorithm.PBKDF1"
+    ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "pbkdf",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "pbkdf2",
+          "type": "substring",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "same-line",
+        "negate_finding": true
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Key Derivation (PBKDF2)",
+    "id": "AI009500",
+    "description": "Cryptography: Key Derivation (PBKDF2)",
+    "tags": [ "Cryptography.KeyDerivation.PBKDF2" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "pbkdf2",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/insider/config/rules/cryptography/protocol.json

@@ -0,0 +1,156 @@
+[
+  {
+    "name": "Cryptography: SSL/TLS Protocol",
+    "id": "AI009600",
+    "description": "Cryptography: SSL/TLS Protocol",
+    "applies_to":[ "csharp" ],
+    "tags":[ "Cryptography.Protocol.TLS" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(SSL|TLS)(v)?([123]{1,2})",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "SslStream|SecurityProtocolType\\.(Ssl|Tls)|SslPolicyErrors|onReceivedSslError|SslContext",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: SSL/TLS Protocol",
+    "id": "AI009700",
+    "description": "Cryptography: SSL/TLS Protocol",
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "tags":[ "Cryptography.Protocol.TLS" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "SECURITY_FLAG_",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "get all non-ignore (see weakssl.json) indicators of ssl"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "SECURITY_FLAG_IGNORE",
+          "type": "substring",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-1,1)",
+        "negate_finding": true
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: SSL/TLS Protocol",
+    "id": "AI009800",
+    "description": "Cryptography: SSL/TLS Protocol",
+    "applies_to": [
+      "c",
+      "objective-c",
+      "swift"
+    ],
+    "tags":[ "Cryptography.Protocol.TLS" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(kCF|NS)StreamSocketSecurityLevel(None|SSLv2|SSLv3|TLSv1|NegotiatedSSL)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "kSSLProtocol(2|3Only|All|Unknown)",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "k(D)?(SSL|TLS)Protocol(1|1Only|2|3Only|All)",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "ssl",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ],
+        "_comment": "e.g. ssl_crl, ssl_ecdh_curve, others"
+      },
+      {
+        "pattern": "SSLCADNRequest|SSLCARevocation|SSLCompression|SSLEngine|SSLFIPS|SSLInsecureRenegotiation",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "SSLOCSP(DefaultResponder|Enable|OverrideResponder|ProxyURL|ResponderTimeout|ResponseMaxAge|ResponseTimeSkew|UseRequestNonce)",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "SSLOpenSSLConfCmd|SSLOptions|SSLPassPhraseDialog|SSLProtocol|SSLProxy",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "SSLRandomSeed|SSLRenegBufferSize|SSLRequire|SSLSessionCache|SSLSRPUnknownUserSeed|SSLSRPVerifierFile|SSLStapling",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "SSLStrictSNIVHostCheck|SSLUserName|SSLUseStapling|SSLVerify",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: SSH Protocol",
+    "id": "AI009900",
+    "description": "Cryptography: SSH Protocol",
+    "tags":[ "Cryptography.Protocol.SSH" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "ssh",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: SSH Protocol",
+    "id": "AI009910",
+    "description": "Cryptography: SSH Protocol",
+    "tags":[ "Cryptography.Protocol.KeyExchange" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "DiffieHellman|ECDsa",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i", "comment" ]
+      }
+    ]
+  }
+]