Merge pull request #7 from pallih/master

Regexes for (possible) SSH keys and PGP private keys

Author: jordan-wright

lib/Paste.py

@@ -56,6 +56,10 @@ def match(self):
             self.type = 'honeypot'
         if regexes['google_api'].search(self.text):
             self.type = 'google_api'
+        if regexes['pgp_private'].search(self.text):
+            self.type = 'pgp_private'
+        if regexes['ssh_private'].search(self.text):
+            self.type = 'ssh_private'
         # if regexes['juniper'].search(self.text): self.type = 'Juniper'
         for regex in regexes['banlist']:
             if regex.search(self.text):

lib/helper.py

@@ -63,6 +63,8 @@ def build_tweet(paste):
             tweet += ' Possible SSH private key'
         elif paste.type == 'honeypot':
             tweet += ' Dionaea Honeypot Log'
+        elif paste.type == 'pgp_private':
+            tweet += ' Found possible PGP Private Key'
         tweet += ' #infoleak'
     if paste.num_emails > 0:
         print(paste.emails)

lib/regexes.py

@@ -10,6 +10,8 @@
     'cisco_pass': re.compile(r'enable\s+password', re.I),
     'google_api': re.compile(r'\W(AIza.{35})'),
     'honeypot': re.compile(r'<dionaea\.capture>', re.I),
+    'pgp_private': re.compile(r'BEGIN PGP PRIVATE', re.I),
+    'ssh_private': re.compile(r'BEGIN RSA PRIVATE'. re.I),
     'db_keywords': [
     re.compile(
     r'((customers?|email|users?|members?|acc(?:oun)?ts?)([-_|/\s]?(address|name|id[^")a-zA-Z0-9_]|[-_:|/\\])))', re.I),