NoseyParker rule fix

- NoseyParker rule fix
This commit is contained in:
Will
2024-03-14 07:22:04 -07:00
parent eb86360a55
commit 47d2220121
@@ -1,5 +1,6 @@
rules:
- name: sha256crypt Hash
id: custom.sha256crypt
pattern: '(\$5\$(?:rounds=\d+\$)?[\./A-Za-z0-9]{1,16}\$(?:(?:[\./A-Za-z0-9]{43})))'
references:
- https://akkadia.org/drepper/SHA-crypt.txt
@@ -13,6 +14,7 @@ rules:
- name: sha512crypt Hash
id: custom.sha512crypt
pattern: '(\$6\$(?:rounds=\d+\$)?[\./A-Za-z0-9]{1,16}\$(?:(?:[\./A-Za-z0-9]{43})))'
references:
- https://akkadia.org/drepper/SHA-crypt.txt
@@ -66,6 +68,7 @@ rules:
# TODO: should the MSSQL hashes also include lower case?
- name: MSSQL 2000 Hash
id: custom.mssql2000
pattern: '(?:(?:.*[^0-9a-zA-Z]+)|(?:\A|\r|\n|\r\n))(0x0100[0-9aA-Z]{88})(?:(?:[^0-9a-zA-Z]+.*)|(?:\z|\r|\n|\r\n))'
references:
- https://passlib.readthedocs.io/en/stable/lib/passlib.hash.mssql2000.html#format-algorithm
@@ -77,6 +80,7 @@ rules:
- name: MSSQL 2012/2014 Hash
id: custom.mssql2012.2014
pattern: '(?:(?:.*[^0-9a-zA-Z]+)|(?:\A|\r|\n|\r\n))(0x0200[0-9aA-Z]{136})(?:(?:[^0-9a-zA-Z]+.*)|(?:\z|\r|\n|\r\n))'
references:
- https://hashcat.net/forum/thread-1474.html
@@ -87,6 +91,7 @@ rules:
- name: CISCO-IOS Type 8 Hash
id: custom.cisco.type8
pattern: '(?:(?:.*[^0-9a-zA-Z]+)|(?:\A|\r|\n|\r\n))(\$8\$[0-9a-zA-Z\./]{14}\$[0-9a-zA-Z\./]{43})(?:(?:[^0-9a-zA-Z]+.*)|(?:\z|\r|\n|\r\n))'
references:
- https://foss.heptapod.net/python-libs/passlib/-/issues/87
@@ -96,6 +101,7 @@ rules:
- name: CISCO-IOS Type 9 Hash
id: custom.cisco.type9
pattern: '(?:(?:.*[^0-9a-zA-Z]+)|(?:\A|\r|\n|\r\n))(\$9\$[0-9a-zA-Z\./]{14}\$[0-9a-zA-Z\./]{43})(?:(?:[^0-9a-zA-Z]+.*)|(?:\z|\r|\n|\r\n))'
references:
- https://foss.heptapod.net/python-libs/passlib/-/issues/87