Package: whispers
Whispers"My little birds are everywhere, even in the North, they whisper to me the strangest stories." -VarysWhispers is astatic structured textanalysis tool designed for parsing various common software config formats in search of hardcoded secrets. Whispers can be used as astandalone executable, or as aPython library, which is meant to facilitate its integration into automated processes and pipelines.:clipboard:Release notes:gear:Request a feature:lady_beetle:Report a bugDownloadELF 64-bit LSB executable, x86-64Mach-O 64-bit x86_64 executablePE32+ executable (console) x86-64Installpip3 install whispersSupported formats:clipboard: Complete coverage for JSON, YAML, XML, andmany other formats.:hammer_and_wrench:Contributeby submitting format samples!DetectsPasswordsAPI tokensCloud keysPrivate keysHashed credentialsAuthentication tokensWebhooksSensitive filesPython functionsSee all rulesUsageCLI# General usage & helpwhispers# More information about Whisperswhispers--info# Show installed versionwhispers--version# Simplest usagewhispersdir/or/file# Write JSON results to a file instead of the screenwhispersdir/or/file-o/tmp/secrets.json# Pipe JSON results downstreamwhispersdir/or/file|jq'.[].value'# Custom usage:#   - only check 'keys' rule group#   - with Critical or High severity#   - everywhere in target/dir except for .log & .raw files (regex)whispers-gkeys-sCritical,High-F'.*\.(log|raw)'target/dir# Configuration file templatewhispers--init>config.yml# Provide custom configuration filewhispers--configconfig.ymldir/or/file# Return custom system code on successwhispers--exitcode7dir/or/file# Include only 'aws-id' & 'aws-secret' rule IDswhispers--rulesaws-id,aws-secretdir/or/file# Exclude 'file-known' rule IDwhispers--xrulesfile-knowndir/or/file# Include only 'keys' & 'misc' rule groupswhispers--groupskeys,miscdir/or/file# Exclude 'files' rule groupwhispers--xgroupsfilesdir/or/file# Include only Critical & High severitywhispers--severityCritical,Highdir/or/file# Exclude all Low severitywhispers--xseverityLowdir/or/file# Include only .json & .yml files (globs)whispers--files'*.json,*.yml'dir/or/file# Exclude .log & .cfg files (regex)whispers--xfiles'.*\.(log|cfg)'dir/or/filePythonimportwhispersargs="-c whispers/config.yml -R file-known -S Info tests/fixtures"forsecretinwhispers.secrets(args):print(f"[{secret.file}:{secret.line}]{secret.key}={secret.value}")Dockerdockerbuild-t=whispers.

dockerrun\--volume$(pwd)/tests/fixtures:/src\--volume$(pwd)/tests/configs/integration.yml:/config.yml\whispers--config/config.yml.ConfigThere are several configuration options available in Whispers. It’s possible to include and exclude results based on file path, keys, values, individual or grouped rules, and severity levels. There is adefault configuration filethat will be used if you don't specify a custom one.Note: all keys and static values are always included, and then filtered out based on config andrules.File path specifications are lists of globsKey and value specifications are lists of regular expressionsRule specifications are lists of rule IDs or inline rule definitionsEverything else is a list of stringsSimple examplesExclude all log files:exclude:files:-.*\.logOnly scan for  level findings in .npmrc files, excluding a known testing value:include:files:-"**/*.npmrc"severity:-Highexclude:values:-^token_for_testing$General config formatinclude:files:-"**/*.yml"# globrules:-password-uri-id:starks# inline rulemessage:Whispers from the Northseverity:Criticalvalue:regex:(Aria|Ned) Starkignorecase:Truegroups:-keysseverity:-Critical-High-Mediumexclude:files:-.*/tests?/# regexkeys:-^foo# regexvalues:-bar$# regexrules:-apikey-knownThe fastest way to tweak detection in a repeatable way (ie: remove false positives and unwanted results) is to copy the defaultconfig.ymlinto a new file, adapt it, and pass it as an argument to Whispers, for example:whispers--init>custom.yml# edit custom.yml as neededwhispers-ccustom.ymltargetSimple filtering based on rules and severity can also be done with CLI arguments directly, without having to provide a config file. Seewhispers --infofor details.RulesGroupRule IDSeverityfilesfile-knownLowinfradockercfgHighinfrahtpasswdMediuminfranpmrcHighinfrapipHighinfrapypircHighkeysapikeyMediumkeysapikey-knownHighkeysapikey-maybeLowkeysaws-idCriticalkeysaws-secretCriticalkeysaws-tokenCriticalkeysprivatekeyHighmisccommentInfomisccreditcardLowmiscsecretLowmiscwebhookLowpasswordspasswordHighpasswordsuriHighpythoncorsLowpythonsystemLowCustom rulesRules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.Custom rules can be defined in the main config file underrules:keyCustom rules can be added towhispers/rulesdirectoryGeneral rule format-id:rule-id# unique rule namegroup:rule-group# rule group namedescription:Values formatted like AWS Session Tokenmessage:AWS Session Token# report will show this messageseverity:Critical# one of Critical, High, Medium, Low, Infokey:# specify key formatregex:(aws.?session.?token)?ignorecase:True# case-insensitive matchingvalue:# specify value formatregex:^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$ignorecase:False# case-sensitive matchingminlen:270# value is at least this longisBase64:True# value is base64-encodedisAscii:False# value is binary data when decodedisUri:False# value is not formatted like a URIsimilar:0.35# maximum allowed Jaro-Winkler similarity# between key and value (1.0 being exactly the same)PluginsAll parsing functionality is implemented viaplugins. Each plugin implements a class with thepairs()method that runs through files and yieldsKeyValuePairobjects to be checked withrules.frompathlibimportPathfromwhispers.models.pairimportKeyValuePairclassPluginName:defpairs(self,filepath:Path)->Iterator[KeyValuePair]:yieldKeyValuePair("key","value",keypath=["path","to","key"],file=filepath.as_posix())Developmentgitclonehttps://github.com/adeptex/whisperscdwhispers
makeinstall-dev
maketestLicenseBSD 3-Clause License