const signatures = [
{
"caption": ".asc file extension",
"description": "Potential cryptographic key bundle",
"hash": "e150e9d",
"name": "asc-file-extension",
"part": "extension",
"pattern": ".asc",
"type": "match"
},
{
"caption": ".p12 file extension",
"description": "PKCS#12 (.p12): potential cryptographic key bundle",
"hash": "5b135b8",
"name": "p-12-file-extension",
"part": "extension",
"pattern": ".p12",
"type": "match"
},
{
"caption": ".pem file extension",
"description": "Potential cryptographic private key",
"hash": "2d98746",
"name": "pem-file-extension",
"part": "extension",
"pattern": ".pem",
"type": "match"
},
{
"caption": ".pfx file extension",
"description": "PKCS#12 (.pfx): Potential cryptographic key bundle",
"hash": "fff92cd",
"name": "pfx-file-extension",
"part": "extension",
"pattern": ".pfx",
"type": "match"
},
{
"caption": ".pkcs12 file extension",
"description": "PKCS#12 (.pkcs12): Potential cryptographic key bundle",
"hash": "8cc89a0",
"name": "pkcs-12-file-extension",
"part": "extension",
"pattern": ".pkcs12",
"type": "match"
},
{
"caption": "1Password password manager database file",
"description": "Feed it to Hashcat and see if you're lucky",
"hash": "3635631",
"name": "1-password-password-manager-database-file",
"part": "extension",
"pattern": ".agilekeychain",
"type": "match"
},
{
"caption": "AWS API Key",
"description": "Imported from truffleHog.",
"hash": "9c723c1",
"name": "aws-api-key",
"part": "contents",
"pattern": "/AKIA[0-9A-Z]{16}/gimu",
"type": "regex"
},
{
"caption": "AWS CLI credentials file",
"description": "",
"hash": "079e003",
"name": "aws-cli-credentials-file",
"part": "path",
"pattern": "/.?aws\\/credentials$/gimu",
"type": "regex"
},
{
"caption": "Apache htpasswd file",
"description": "",
"hash": "c95a054",
"name": "apache-htpasswd-file",
"part": "filename",
"pattern": "/^.?htpasswd$/gimu",
"type": "regex"
},
{
"caption": "Apple Keychain database file",
"description": "",
"hash": "cd5c661",
"name": "apple-keychain-database-file",
"part": "extension",
"pattern": ".keychain",
"type": "match"
},
{
"caption": "Azure service configuration schema file",
"description": "",
"hash": "78f15a0",
"name": "azure-service-configuration-schema-file",
"part": "extension",
"pattern": ".cscfg",
"type": "match"
},
{
"caption": "Carrierwave configuration file",
"description": "Can contain credentials for cloud storage systems such as Amazon S3 and Google Storage",
"hash": "f230327",
"name": "carrierwave-configuration-file",
"part": "filename",
"pattern": "carrierwave.rb",
"type": "match"
},
{
"caption": "Chef Knife configuration file",
"description": "Can contain references to Chef servers",
"hash": "638a5a0",
"name": "chef-knife-configuration-file",
"part": "filename",
"pattern": "knife.rb",
"type": "match"
},
{
"caption": "Chef private key",
"description": "Can be used to authenticate against Chef servers",
"hash": "0e7cf29",
"name": "chef-private-key",
"part": "path",
"pattern": "/.?chef\\/(.*).pem$/gimu",
"type": "regex"
},
{
"caption": "Configuration file for auto-login process",
"description": "Can contain username and password",
"hash": "9ab276c",
"name": "configuration-file-for-auto-login-process",
"part": "filename",
"pattern": "/^(.|_)?netrc$/gimu",
"type": "regex"
},
{
"caption": "Contains word: credential",
"description": "",
"hash": "c8ea9d9",
"name": "contains-word-credential",
"part": "path",
"pattern": "/credential/gimu",
"type": "regex"
},
{
"caption": "Contains word: password",
"description": "",
"hash": "2558e2f",
"name": "contains-word-password",
"part": "path",
"pattern": "/password/gimu",
"type": "regex"
},
{
"caption": "DBeaver SQL database manager configuration file",
"description": "",
"hash": "164e2e1",
"name": "d-beaver-sql-database-manager-configuration-file",
"part": "filename",
"pattern": "/^.?dbeaver-data-sources.xml$/gimu",
"type": "regex"
},
{
"caption": "Day One journal file",
"description": "Now it's getting creepy...",
"hash": "5dd41fa",
"name": "day-one-journal-file",
"part": "extension",
"pattern": ".dayone",
"type": "match"
},
{
"caption": "DigitalOcean doctl command-line client configuration file",
"description": "Contains DigitalOcean API key and other information",
"hash": "4f1dfbb",
"name": "digital-ocean-doctl-command-line-client-configuration-file",
"part": "path",
"pattern": "/doctl\\/config.yaml$/gimu",
"type": "regex"
},
{
"caption": "Django configuration file",
"description": "Can contain database credentials, cloud storage system credentials, and other secrets",
"hash": "e6ab872",
"name": "django-configuration-file",
"part": "filename",
"pattern": "settings.py",
"type": "match"
},
{
"caption": "Docker configuration file",
"description": "Can contain credentials for public or private Docker registries",
"hash": "c3bc3b0",
"name": "docker-configuration-file",
"part": "filename",
"pattern": "/^.?dockercfg$/gimu",
"type": "regex"
},
{
"caption": "Environment configuration file",
"description": "",
"hash": "6144323",
"name": "environment-configuration-file",
"part": "filename",
"pattern": "/^.?env$/gimu",
"type": "regex"
},
{
"caption": "Facebook Oauth",
"description": "Imported from truffleHog.",
"hash": "65082c3",
"name": "facebook-oauth",
"part": "contents",
"pattern": "/[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K].*['|\"][0-9a-f]{32}['|\"]/gimu",
"type": "regex"
},
{
"caption": "FileZilla FTP configuration file",
"description": "Can contain credentials for FTP servers",
"hash": "1117b7f",
"name": "file-zilla-ftp-configuration-file",
"part": "filename",
"pattern": "filezilla.xml",
"type": "match"
},
{
"caption": "FileZilla FTP recent servers file",
"description": "Can contain credentials for FTP servers",
"hash": "bfdaf5f",
"name": "file-zilla-ftp-recent-servers-file",
"part": "filename",
"pattern": "recentservers.xml",
"type": "match"
},
{
"caption": "GNOME Keyring database file",
"description": "",
"hash": "8c3c9ad",
"name": "gnome-keyring-database-file",
"part": "extension",
"pattern": "/^key(store|ring)$/gimu",
"type": "regex"
},
{
"caption": "Generic API Key",
"description": "Imported from truffleHog.",
"hash": "b81bc8f",
"name": "generic-api-key",
"part": "contents",
"pattern": "/[a|A][p|P][i|I][_]?[k|K][e|E][y|Y].*['|\"][0-9a-zA-Z]{32,45}['|\"]/gimu",
"type": "regex"
},
{
"caption": "Generic Secret",
"description": "Imported from truffleHog.",
"hash": "da55948",
"name": "generic-secret",
"part": "contents",
"pattern": "/[s|S][e|E][c|C][r|R][e|E][t|T].*['|\"][0-9a-zA-Z]{32,45}['|\"]/gimu",
"type": "regex"
},
{
"caption": "Git configuration file",
"description": "",
"hash": "2b12c64",
"name": "git-configuration-file",
"part": "filename",
"pattern": "/^.?gitconfig$/gimu",
"type": "regex"
},
{
"caption": "GitHub",
"description": "Imported from truffleHog.",
"hash": "9106980",
"name": "git-hub",
"part": "contents",
"pattern": "/[g|G][i|I][t|T][h|H][u|U][b|B].*['|\"][0-9a-zA-Z]{35,40}['|\"]/gimu",
"type": "regex"
},
{
"caption": "GitHub Hub command-line client configuration file",
"description": "Can contain GitHub API access token",
"hash": "60e1441",
"name": "git-hub-hub-command-line-client-configuration-file",
"part": "path",
"pattern": "/config\\/hub$/gimu",
"type": "regex"
},
{
"caption": "GnuCash database file",
"description": "",
"hash": "7571675",
"name": "gnu-cash-database-file",
"part": "extension",
"pattern": ".gnucash",
"type": "match"
},
{
"caption": "Google (GCP) Service-account",
"description": "Imported from truffleHog.",
"hash": "24e608a",
"name": "google-gcp-service-account",
"part": "contents",
"pattern": "/\"type\": \"service_account\"/gimu",
"type": "regex"
},
{
"caption": "Google Oauth",
"description": "Imported from truffleHog.",
"hash": "6f27008",
"name": "google-oauth",
"part": "contents",
"pattern": "/(\"client_secret\":\"[a-zA-Z0-9-_]{24}\")/gimu",
"type": "regex"
},
{
"caption": "Heroku API Key",
"description": "Imported from truffleHog.",
"hash": "d0e4b46",
"name": "heroku-api-key",
"part": "contents",
"pattern": "/[h|H][e|E][r|R][o|O][k|K][u|U].*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}/gimu",
"type": "regex"
},
{
"caption": "Hexchat/XChat IRC client server list configuration file",
"description": "",
"hash": "e38fd5c",
"name": "hexchat-x-chat-irc-client-server-list-configuration-file",
"part": "path",
"pattern": "/.?xchat2?\\/servlist_?.conf$/gimu",
"type": "regex"
},
{
"caption": "Irssi IRC client configuration file",
"description": "",
"hash": "fe19d1d",
"name": "irssi-irc-client-configuration-file",
"part": "path",
"pattern": "/.?irssi\\/config$/gimu",
"type": "regex"
},
{
"caption": "Java keystore file",
"description": "",
"hash": "eeb2d09",
"name": "java-keystore-file",
"part": "extension",
"pattern": ".jks",
"type": "match"
},
{
"caption": "Jenkins publish over SSH plugin file",
"description": "",
"hash": "0ff8712",
"name": "jenkins-publish-over-ssh-plugin-file",
"part": "filename",
"pattern": "jenkins.plugins.publish_over_ssh.BapSshPublisherPlugin.xml",
"type": "match"
},
{
"caption": "KDE Wallet Manager database file",
"description": "",
"hash": "f9ff1dc",
"name": "kde-wallet-manager-database-file",
"part": "extension",
"pattern": ".kwallet",
"type": "match"
},
{
"caption": "KeePass password manager database file",
"description": "Feed it to Hashcat and see if you're lucky",
"hash": "bca670c",
"name": "kee-pass-password-manager-database-file",
"part": "extension",
"pattern": "/^kdbx?$/gimu",
"type": "regex"
},
{
"caption": "Little Snitch firewall configuration file",
"description": "Contains traffic rules for applications",
"hash": "3f54f31",
"name": "little-snitch-firewall-configuration-file",
"part": "filename",
"pattern": "configuration.user.xpl",
"type": "match"
},
{
"caption": "Log file",
"description": "Log files can contain secret HTTP endpoints, session IDs, API keys and other goodies",
"hash": "de8c348",
"name": "log-file",
"part": "extension",
"pattern": ".log",
"type": "match"
},
{
"caption": "Microsoft BitLocker Trusted Platform Module password file",
"description": "",
"hash": "c7957b1",
"name": "microsoft-bit-locker-trusted-platform-module-password-file",
"part": "extension",
"pattern": ".tpm",
"type": "match"
},
{
"caption": "Microsoft BitLocker recovery key file",
"description": "",
"hash": "16fcdae",
"name": "microsoft-bit-locker-recovery-key-file",
"part": "extension",
"pattern": ".bek",
"type": "match"
},
{
"caption": "Microsoft SQL database file",
"description": "",
"hash": "705a708",
"name": "microsoft-sql-database-file",
"part": "extension",
"pattern": ".mdf",
"type": "match"
},
{
"caption": "Microsoft SQL server compact database file",
"description": "",
"hash": "22802d0",
"name": "microsoft-sql-server-compact-database-file",
"part": "extension",
"pattern": ".sdf",
"type": "match"
},
{
"caption": "Mutt e-mail client configuration file",
"description": "",
"hash": "5a7debd",
"name": "mutt-e-mail-client-configuration-file",
"part": "filename",
"pattern": "/^.?muttrc$/gimu",
"type": "regex"
},
{
"caption": "MySQL client command history file",
"description": "",
"hash": "50fc849",
"name": "my-sql-client-command-history-file",
"part": "filename",
"pattern": "/^.?mysql_history$/gimu",
"type": "regex"
},
{
"caption": "NPM configuration file",
"description": "Can contain credentials for NPM registries",
"hash": "f2b6773",
"name": "npm-configuration-file",
"part": "filename",
"pattern": "/^.?npmrc$/gimu",
"type": "regex"
},
{
"caption": "Network traffic capture file",
"description": "",
"hash": "acbfb06",
"name": "network-traffic-capture-file",
"part": "extension",
"pattern": ".pcap",
"type": "match"
},
{
"caption": "OmniAuth configuration file",
"description": "The OmniAuth configuration file can contain client application secrets",
"hash": "ac2c2e6",
"name": "omni-auth-configuration-file",
"part": "filename",
"pattern": "omniauth.rb",
"type": "match"
},
{
"caption": "OpenVPN client configuration file",
"description": "",
"hash": "3d0101c",
"name": "open-vpn-client-configuration-file",
"part": "extension",
"pattern": ".ovpn",
"type": "match"
},
{
"caption": "PGP private key block",
"description": "Imported from truffleHog.",
"hash": "42a3903",
"name": "pgp-private-key-block",
"part": "contents",
"pattern": "/-----BEGIN PGP PRIVATE KEY BLOCK-----/gimu",
"type": "regex"
},
{
"caption": "PHP configuration file",
"description": "",
"hash": "ed14663",
"name": "php-configuration-file",
"part": "filename",
"pattern": "/config(.inc)?.php$/gimu",
"type": "regex"
},
{
"caption": "Password Safe database file",
"description": "",
"hash": "9719be2",
"name": "password-safe-database-file",
"part": "extension",
"pattern": ".psafe3",
"type": "match"
},
{
"caption": "Password in URL",
"description": "Imported from truffleHog.",
"hash": "05bbc15",
"name": "password-in-url",
"part": "contents",
"pattern": "/[a-zA-Z]{3,10}:\\/\\/[^\\/\\s:@]{3,20}:[^\\/\\s:@]{3,20}@.{1,100}[\"'\\s]/gimu",
"type": "regex"
},
{
"caption": "Pidgin OTR private key",
"description": "",
"hash": "0ebd5ab",
"name": "pidgin-otr-private-key",
"part": "filename",
"pattern": "otr.private_key",
"type": "match"
},
{
"caption": "Pidgin chat client account configuration file",
"description": "",
"hash": "c03a1bf",
"name": "pidgin-chat-client-account-configuration-file",
"part": "path",
"pattern": "/.?purple\\/accounts.xml$/gimu",
"type": "regex"
},
{
"caption": "PostgreSQL client command history file",
"description": "",
"hash": "049e6ba",
"name": "postgre-sql-client-command-history-file",
"part": "filename",
"pattern": "/^.?psql_history$/gimu",
"type": "regex"
},
{
"caption": "PostgreSQL password file",
"description": "",
"hash": "d97e0ae",
"name": "postgre-sql-password-file",
"part": "filename",
"pattern": "/^.?pgpass$/gimu",
"type": "regex"
},
{
"caption": "Potential Jenkins credentials file",
"description": "",
"hash": "5b8c9ad",
"name": "potential-jenkins-credentials-file",
"part": "filename",
"pattern": "credentials.xml",
"type": "match"
},
{
"caption": "Potential Linux passwd file",
"description": "Contains system user information",
"hash": "5e7ad75",
"name": "potential-linux-passwd-file",
"part": "path",
"pattern": "/etc\\/passwd$/gimu",
"type": "regex"
},
{
"caption": "Potential Linux shadow file",
"description": "Contains hashed passwords for system users",
"hash": "1888752",
"name": "potential-linux-shadow-file",
"part": "path",
"pattern": "/etc\\/shadow$/gimu",
"type": "regex"
},
{
"caption": "Potential MediaWiki configuration file",
"description": "",
"hash": "a948202",
"name": "potential-media-wiki-configuration-file",
"part": "filename",
"pattern": "LocalSettings.php",
"type": "match"
},
{
"caption": "Potential Ruby On Rails database configuration file",
"description": "Can contain database credentials",
"hash": "432e204",
"name": "potential-ruby-on-rails-database-configuration-file",
"part": "filename",
"pattern": "database.yml",
"type": "match"
},
{
"caption": "Potential cryptographic private key",
"description": "",
"hash": "09d211f",
"name": "potential-cryptographic-private-key",
"part": "extension",
"pattern": "/^key(pair)?$/gimu",
"type": "regex"
},
{
"caption": "Potential jrnl journal file",
"description": "Now it's getting creepy...",
"hash": "edbf52f",
"name": "potential-jrnl-journal-file",
"part": "filename",
"pattern": "journal.txt",
"type": "match"
},
{
"caption": "Private SSH key",
"description": "_rsa",
"hash": "2eba32c",
"name": "private-ssh-key",
"part": "filename",
"pattern": "/^.*_rsa$/gimu",
"type": "regex"
},
{
"caption": "Private SSH key",
"description": "_dsa",
"hash": "9225485",
"name": "private-ssh-key",
"part": "filename",
"pattern": "/^.*_dsa$/gimu",
"type": "regex"
},
{
"caption": "Private SSH key",
"description": "_ed25519",
"hash": "6657af1",
"name": "private-ssh-key",
"part": "filename",
"pattern": "/^.*_ed25519$/gimu",
"type": "regex"
},
{
"caption": "Private SSH key",
"description": "_ecdsa",
"hash": "2131c8a",
"name": "private-ssh-key",
"part": "filename",
"pattern": "/^.*_ecdsa$/gimu",
"type": "regex"
},
{
"caption": "RSA private key",
"description": "Imported from truffleHog.",
"hash": "d27a8c7",
"name": "rsa-private-key",
"part": "contents",
"pattern": "/-----BEGIN RSA PRIVATE KEY-----/gimu",
"type": "regex"
},
{
"caption": "Recon-ng web reconnaissance framework API key database",
"description": "",
"hash": "e404a55",
"name": "recon-ng-web-reconnaissance-framework-api-key-database",
"part": "path",
"pattern": "/.?recon-ng\\/keys.db$/gimu",
"type": "regex"
},
{
"caption": "Remote Desktop connection file",
"description": "",
"hash": "2012d08",
"name": "remote-desktop-connection-file",
"part": "extension",
"pattern": ".rdp",
"type": "match"
},
{
"caption": "Robomongo MongoDB manager configuration file",
"description": "Can contain credentials for MongoDB databases",
"hash": "725d1bc",
"name": "robomongo-mongo-db-manager-configuration-file",
"part": "filename",
"pattern": "robomongo.json",
"type": "match"
},
{
"caption": "Ruby IRB console history file",
"description": "",
"hash": "52a9454",
"name": "ruby-irb-console-history-file",
"part": "filename",
"pattern": "/^.?irb_history$/gimu",
"type": "regex"
},
{
"caption": "Ruby On Rails secret token configuration file",
"description": "If the Rails secret token is known, it can allow for remote code execution (http://www.exploit-db.com/exploits/27527/)",
"hash": "59bd2b6",
"name": "ruby-on-rails-secret-token-configuration-file",
"part": "filename",
"pattern": "secret_token.rb",
"type": "match"
},
{
"caption": "Rubygems credentials file",
"description": "Can contain API key for a rubygems.org account",
"hash": "6de3cc8",
"name": "rubygems-credentials-file",
"part": "path",
"pattern": "/.?gem\\/credentials$/gimu",
"type": "regex"
},
{
"caption": "S3cmd configuration file",
"description": "",
"hash": "805448e",
"name": "s-3-cmd-configuration-file",
"part": "filename",
"pattern": "/^.?s3cfg$/gimu",
"type": "regex"
},
{
"caption": "SFTP connection configuration file",
"description": "",
"hash": "4a87e80",
"name": "sftp-connection-configuration-file",
"part": "filename",
"pattern": "/^sftp-config(.json)?$/gimu",
"type": "regex"
},
{
"caption": "SQL dump file",
"description": "",
"hash": "45c4922",
"name": "sql-dump-file",
"part": "extension",
"pattern": "/^sql(dump)?$/gimu",
"type": "regex"
},
{
"caption": "SQLite database file",
"description": "",
"hash": "d81a39b",
"name": "sq-lite-database-file",
"part": "extension",
"pattern": ".sqlite",
"type": "match"
},
{
"caption": "SSH (DSA) private key",
"description": "Imported from truffleHog.",
"hash": "147dea0",
"name": "ssh-dsa-private-key",
"part": "contents",
"pattern": "/-----BEGIN DSA PRIVATE KEY-----/gimu",
"type": "regex"
},
{
"caption": "SSH (EC) private key",
"description": "Imported from truffleHog.",
"hash": "c6706b5",
"name": "ssh-ec-private-key",
"part": "contents",
"pattern": "/-----BEGIN EC PRIVATE KEY-----/gimu",
"type": "regex"
},
{
"caption": "SSH (OPENSSH) private key",
"description": "Imported from truffleHog.",
"hash": "6ee984c",
"name": "ssh-openssh-private-key",
"part": "contents",
"pattern": "/-----BEGIN OPENSSH PRIVATE KEY-----/gimu",
"type": "regex"
},
{
"caption": "SSH configuration file",
"description": "",
"hash": "5b3d861",
"name": "ssh-configuration-file",
"part": "path",
"pattern": "/.?ssh\\/config$/gimu",
"type": "regex"
},
{
"caption": "Sequel Pro MySQL database manager bookmark file",
"description": "",
"hash": "b4b0a84",
"name": "sequel-pro-my-sql-database-manager-bookmark-file",
"part": "filename",
"pattern": "Favorites.plist",
"type": "match"
},
{
"caption": "Shell command alias configuration file",
"description": "Shell configuration files can contain passwords, API keys, hostnames and other goodies",
"hash": "6354201",
"name": "shell-command-alias-configuration-file",
"part": "filename",
"pattern": "/^.?(bash_|zsh_)?aliases$/gimu",
"type": "regex"
},
{
"caption": "Shell command history file",
"description": "",
"hash": "58036b8",
"name": "shell-command-history-file",
"part": "filename",
"pattern": "/^.?(bash_|zsh_|sh_|z)?history$/gimu",
"type": "regex"
},
{
"caption": "Shell configuration file",
"description": "(.exports): Shell configuration files can contain passwords, API keys, hostnames and other goodies",
"hash": "c552e83",
"name": "shell-configuration-file",
"part": "filename",
"pattern": ".exports",
"type": "match"
},
{
"caption": "Shell configuration file",
"description": "(.functions): Shell configuration files can contain passwords, API keys, hostnames and other goodies",
"hash": "eec3370",
"name": "shell-configuration-file",
"part": "filename",
"pattern": ".functions",
"type": "match"
},
{
"caption": "Shell configuration file",
"description": "(.extra): Shell configuration files can contain passwords, API keys, hostnames and other goodies",
"hash": "c798ed0",
"name": "shell-configuration-file",
"part": "filename",
"pattern": ".extra",
"type": "match"
},
{
"caption": "Shell configuration file",
"description": "(bash, zsh, csh): Shell configuration files can contain passwords, API keys, hostnames and other goodies",
"hash": "b208b37",
"name": "shell-configuration-file",
"part": "filename",
"pattern": "/^.?(bash|zsh|csh)rc$/gimu",
"type": "regex"
},
{
"caption": "Shell profile configuration file",
"description": "(profile): Shell configuration files can contain passwords, API keys, hostnames and other goodies",
"hash": "3380457",
"name": "shell-profile-configuration-file",
"part": "filename",
"pattern": "/^.?(bash_|zsh_)?profile$/gimu",
"type": "regex"
},
{
"caption": "Slack Token",
"description": "Imported from truffleHog.",
"hash": "d1996b6",
"name": "slack-token",
"part": "contents",
"pattern": "/(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})/gimu",
"type": "regex"
},
{
"caption": "Slack Webhook",
"description": "Imported from truffleHog.",
"hash": "cd1f086",
"name": "slack-webhook",
"part": "contents",
"pattern": "/https:\\/\\/hooks.slack.com\\/services\\/T[a-zA-Z0-9_]{8}\\/B[a-zA-Z0-9_]{8}\\/[a-zA-Z0-9_]{24}/gimu",
"type": "regex"
},
{
"caption": "T command-line Twitter client configuration file",
"description": "",
"hash": "cc926b5",
"name": "t-command-line-twitter-client-configuration-file",
"part": "filename",
"pattern": "/^.?trc$/gimu",
"type": "regex"
},
{
"caption": "Terraform variable config file",
"description": "Can contain credentials for terraform providers",
"hash": "4e2d1bb",
"name": "terraform-variable-config-file",
"part": "filename",
"pattern": "terraform.tfvars",
"type": "match"
},
{
"caption": "Tugboat DigitalOcean management tool configuration",
"description": "",
"hash": "91483bf",
"name": "tugboat-digital-ocean-management-tool-configuration",
"part": "filename",
"pattern": "/^.?tugboat$/gimu",
"type": "regex"
},
{
"caption": "Tunnelblick VPN configuration file",
"description": "",
"hash": "10a8fd6",
"name": "tunnelblick-vpn-configuration-file",
"part": "extension",
"pattern": ".tblk",
"type": "match"
},
{
"caption": "Twilio API Key",
"description": "Imported from truffleHog.",
"hash": "7ba3308",
"name": "twilio-api-key",
"part": "contents",
"pattern": "/SK[a-z0-9]{32}/gimu",
"type": "regex"
},
{
"caption": "Twitter Oauth",
"description": "Imported from truffleHog.",
"hash": "6894a00",
"name": "twitter-oauth",
"part": "contents",
"pattern": "/[t|T][w|W][i|I][t|T][t|T][e|E][r|R].*['|\"][0-9a-zA-Z]{35,44}['|\"]/gimu",
"type": "regex"
},
{
"caption": "Ventrilo server configuration file",
"description": "Can contain passwords",
"hash": "ba757a9",
"name": "ventrilo-server-configuration-file",
"part": "filename",
"pattern": "ventrilo_srv.ini",
"type": "match"
},
{
"caption": "Windows BitLocker full volume encrypted data file",
"description": "",
"hash": "eb6e6a6",
"name": "windows-bit-locker-full-volume-encrypted-data-file",
"part": "extension",
"pattern": ".fve",
"type": "match"
},
{
"caption": "cPanel backup ProFTPd credentials file",
"description": "Contains usernames and password hashes for FTP accounts",
"hash": "e071b05",
"name": "c-panel-backup-pro-ft-pd-credentials-file",
"part": "filename",
"pattern": "proftpdpasswd",
"type": "match"
},
{
"caption": "git-credential-store helper credentials file",
"description": "",
"hash": "861aed1",
"name": "git-credential-store-helper-credentials-file",
"part": "filename",
"pattern": "/^.?git-credentials$/gimu",
"type": "regex"
},
{
"caption": "gitrob configuration file",
"description": "",
"hash": "c7ae3e6",
"name": "gitrob-configuration-file",
"part": "filename",
"pattern": "/^.?gitrobrc$/gimu",
"type": "regex"
}
]