diff --git a/lib/Paste.py b/lib/Paste.py index 7ffb3d9..c580e31 100644 --- a/lib/Paste.py +++ b/lib/Paste.py @@ -60,6 +60,8 @@ def match(self): self.type = 'pgp_private' if regexes['ssh_private'].search(self.text): self.type = 'ssh_private' + if regexes['telegram_bot'].search(self.text): + self.type = 'telegram_bot' # if regexes['juniper'].search(self.text): self.type = 'Juniper' for regex in regexes['banlist']: if regex.search(self.text): diff --git a/lib/helper.py b/lib/helper.py index a58ad0d..6b4b14e 100644 --- a/lib/helper.py +++ b/lib/helper.py @@ -61,6 +61,8 @@ def build_tweet(paste): tweet += ' Possible ' + paste.type + ' configuration' elif paste.type == 'ssh_private': tweet += ' Possible SSH private key' + elif paste.type == 'telegram_bot': + tweet += ' Possible Telegram Bot API key' elif paste.type == 'honeypot': tweet += ' Dionaea Honeypot Log' elif paste.type == 'pgp_private': diff --git a/lib/regexes.py b/lib/regexes.py index 3c4ecab..8fd8174 100644 --- a/lib/regexes.py +++ b/lib/regexes.py @@ -12,6 +12,7 @@ 'honeypot': re.compile(r'', re.I), 'pgp_private': re.compile(r'BEGIN PGP PRIVATE', re.I), 'ssh_private': re.compile(r'BEGIN RSA PRIVATE', re.I), + 'telegram_bot': re.compile(r'\d{9}:[0-9A-Za-z_-]{35}'), 'db_keywords': [ re.compile(r'((customers?|email|users?|members?|acc(?:oun)?ts?)([-_|/\s]?(address|name|id[^")a-zA-Z0-9_]|[-_:|/\\])))', re.I), re.compile(r'((\W?pass(wor)?d|hash)[\s|:])', re.I),