Badsecrets 使用指南：检测Web框架中的敏感信息

一、Badsecrets 概述

Badsecrets 是一个功能强大的 Python 代码库，专门用于从多种 Web 框架中检测已知的敏感信息。它基于纯 Python 开发，主要目标是识别在各种平台上使用已知或脆弱的加密敏感信息。

核心特点

作为"已知敏感信息"的存储库（如 ASP.NET 机器密钥等教程示例）
提供与语言无关的抽象层来识别敏感信息的使用
支持多种 Web 框架和技术的检测

二、工具模块详解

Badsecrets 包含以下检测模块：

模块名称	检测目标
ASPNET_Viewstate	检查视图状态/生成器是否使用已知设备密钥
Telerik_HashKey	检查已修复的 Telerik UI(2017+)版本是否存在已知的 Telerik.Upload.ConfigurationHashKey
Telerik_EncryptionKey	检查已修复的 Telerik UI(2017+)版本是否存在已知的 Telerik.Web.UI.DialogParametersEncryptionKey
Flask_SignedCookies	检查 Flask Cookie 弱签名密码
Peoplesoft_PSToken	检查 Peoplesoft PS_TOKEN 是否存在错误/弱签名密码
Django_SignedCookies	检查 Django 的会话 cookie(在 signed_cookie 模式下)是否存在已知的 Django secret_key
Rails_SecretKeyBase	检查 Ruby on Rails 签名或加密的会话 cookie 是否存在已知的 secret_key_base
Generic_JWT	检查 JWT 中已知的 HMAC 敏感信息或 RSA 私钥
Jsf_viewstate	检查 Java Server Faces(JSF)的 Mojarra 和 Myfaces 实现是否使用了已知或弱密钥
Symfony_SignedURL	检查 Symfony 的"_fragment"url 中是否存在已知的 HMAC 密钥
Express_SignedCookies_ES	检查 express.js 的 express 会话中间件的签名 cookie 和会话 cookie 的已知"会话机密"
Express_SignedCookies_CS	检查 express.js 的 cookie 会话中间件的签名 cookie 和会话 cookie 的已知机密
Laravel_SignedCookies	检查"laravel_session"cookie 中是否存在已知的 Laravel "APP_KEY"
ASPNET_Vstate	检查自定义压缩的 Viewstate 代码段是否存在 RCE 漏洞

三、安装方法

通过 Git 克隆

git clone https://github.com/blacklanternsecurity/badsecrets.git

通过 pip 安装

pip install badsecrets

四、基本使用方法

1. 命令行直接使用

badsecrets eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo

2. 调用脚本使用

python ./badsecrets/examples/cli.py eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo

3. 命令行帮助信息

badsecrets -h

输出：

usage: badsecrets [-h] [-nc] [-u URL] [-nh] [-c CUSTOM_SECRETS] [-p PROXY] [-a USER_AGENT] [product ...]

Check cryptographic products against badsecrets library

positional arguments:
  product              用于检查已知机密的加密产品

options:
  -h, --help           显示工具帮助信息和退出
  -nc, --no-color      禁用颜色高亮显示
  -u URL, --url URL    使用URL模式,指定目标页面URL地址
  -nh, --no-hashcat    当找不到敏感信息时,尝试跳过hashcat兼容性检查
  -c CUSTOM_SECRETS, --custom-secrets CUSTOM_SECRETS
                        引入要与默认敏感信息一起加载的自定义机密文件
  -p PROXY, --proxy PROXY
                        在URL模式下,指定一个HTTP代理
  -a USER_AGENT, --user-agent USER_AGENT
                        在URL模式下,设置一个自定义user-agent

五、使用示例

1. 检查加密产品中的已知敏感信息(针对所有模块)

badsecrets eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo

2. URL 模式下检测目标

badsecrets --url http://example.com/contains_bad_secret.html

3. 输出示例

$ badsecrets eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo
v0.3.337
Known Secret Found!
Detecting Module: Generic_JWT
Product Type: JSON Web Token (JWT)
Product: eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo
Secret Type: HMAC/RSA Key
Location: manual
Secret: 1234
Details: {'Issuer': 'Issuer', 'Username': 'BadSecrets', 'exp': 1593133483, 'iat': 1466903083, 'jwt_headers': {'alg': 'HS256'}}

六、作为代码库使用

1. 导入模块

from badsecrets import modules_loaded

Django_SignedCookies = modules_loaded["django_signedcookies"]
ASPNET_Viewstate = modules_loaded["aspnet_viewstate"]
Flask_SignedCookies = modules_loaded["flask_signedcookies"]
Peoplesoft_PSToken = modules_loaded["peoplesoft_pstoken"]
Telerik_HashKey = modules_loaded["telerik_hashkey"]
Telerik_EncryptionKey = modules_loaded["telerik_encryptionkey"]
Rails_SecretKeyBase = modules_loaded["rails_secretkeybase"]
Generic_JWT = modules_loaded["generic_jwt"]
Jsf_viewstate = modules_loaded["jsf_viewstate"]
Symfony_SignedURL = modules_loaded["symfony_signedurl"]
Express_SignedCookies_ES = modules_loaded["express_signedcookies_es"]
Express_SignedCookies_CS = modules_loaded["express_signedcookies_cs"]
Laravel_SignedCookies = modules_loaded["laravel_signedcookies"]
ASPNET_Vstate = modules_loaded["aspnet_vstate"]

2. 各模块使用示例

ASPNET_Viewstate 示例

x = ASPNET_Viewstate()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("AgF5WuyVO11CsYJ1K5rjyuLXqUGCITSOapG1cYNiriYQ6VTKochMpn8ws4eJRvft81nQIA==","EDD8C9AE")
if r: 
    print(r)
else: 
    print("KEY NOT FOUND :(")

Telerik_HashKey 示例

x = Telerik_HashKey()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("vpwClvnLODIx9te2vO%2F4e06KzbKkjtwmNnMx09D1Dmau0dPliYzgpqB9MnEqhPNe3fWemQyH25eLULJi8KiYHXeHvjfS1TZAL2o5Gku1gJbLuqusRXZQYTNlU2Aq4twXO0o0CgVUTfknU89iw0ceyaKjSteOhxGvaE3VEDfiKDd8%2B9j9vD3qso0mLMqn%2Btxirc%2FkIq5oBbzOCgMrJjkaPMa2SJpc5QI2amffBJ%2BsAN25VH%2BwabEJXrjRy%2B8NlYCoUQQKrI%2BEzRSdBsiMOxQTD4vz2TCjSKrK5JEeFMTyE7J39MhXFG38Bq%2FZMDO%2FETHHdsBtTTkqzJ2odVArcOzrce3Kt2%2FqgTUPW%2BCjFtkSNmh%2FzlB9BhbxB1kJt1NkNsjywvP9j7PvNoOBJsa8OwpEyrPTT3Gm%2BfhDwtjvwpvN7l7oIfbcERGExAFrAMENOOt4WGlYhF%2F8c9NcDv0Bv3YJrJoGq0rRurXSh9kcwum9nB%2FGWcjPikqTDm6p3Z48hEnQCVuJNkwJwIKEsYxJqCL95IEdX3PzR81zf36uXPlEa3YdeAgM1RD8YGlwlIXnrLhvMbRvQW0W9eoPzE%2FjP68JGUIZc1TwTQusIWjnuVubFTEUMDLfDNk12tMwM9mfnwT8lWFTMjv9pF70W5OtO7gVN%2BOmCxqAuQmScRVExNds%2FF%2FPli4oxRKfgI7FhAaC%2Fu1DopZ6vvBdUq1pBQE66fQ9SnxRTmIClCpULUhNO90ULTpUi9ga2UtBCTzI8z6Sb6qyQ52NopNZMFdrn9orzdP8oqFeyYpF%2BQEtbp%2F5AMENkFkWUxHZn8NoSlO8P6G6ubSyDdY4QJPaFS4FxNhhm85WlZC9xfEZ1AGSSBOu9JJVYiKxXnL1yYLqrlWp5mfBHZeUBwEa%2FMjGxZEVYDhXo4PiU0jxN7fYmjaobp3DSgA5H3BcFuNG5d8CUnOlQcEie5b%2BUHOpI9zAk7qcuEUXbaZ5Mvh0t2jXCRALRKYDyBdbHlWAFo10dTIM6L3aSTM5uEz9%2FalXLXoWlMo7dTDpuO5bBfTq7YkoPExL3g3JJX47UhuLq85i3%2Bzxfvd7r%2Fmid69kbD3PnX%2Bj0QxaiShhyOZg6jl1HMeRRXvZap3FPCIfxbCf7j2TRqB5gYefBIIdGYjrdiL6HS8SbjXcROMwh2Fxnt505X4jmkmDcGmneU3z%2B84TSSFewcSpxGEGvHVkkU4OaT6vyFwsxCmdrR187tQZ7gn3ZkAiTps%2FfOPcL5QWXja06Z%2FHT3zboq6Hj9v9NBHzpC1eAK0YN8r4V2UMI3P0%2FsIPQYXhovoeLjJwq6snKZTX37ulE1mbS1uOY%2BZrvFYbLN5DdNL%2B%2Bl%2F%2BcWIpc0RSYBLo19xHpKeoeLjU2sxaYzK%2B92D4zKANdPPvsHPqJD1Y%2FBwCL%2FfZKaJfRK9Bj09ez1Z1ixTEKjIRCwuxijnJGq33faZchbwpMPpTfv43jEriGwXwoqOo9Mbj9ggPAil7O81XZxNT4vv4RoxXTN93V100rt3ClXauL%2BlNID%2BseN2CEZZqnygpTDf2an%2FVsmJGJJcc0goW3l43mhx2U79zeuT94cFPGpvITEbMtjmuNsUbOBuw6nqm5rAs%2FxjIsDRqfQxGQWfS0kuwuU6RRmiME2Ps0NrBENIbZzcbgw6%2BRIwClWkvEG%2BK%2FPdcAdfmRkAPWUNadxnhjeU2jNnzI1yYNIOhziUBPxgFEcAT45E7rWvf8ghT08HZvphzytPmD%2FxuvJaDdRgb6a30TjSpa7i%2BEHkIMxM5eH1kiwhN6xkTcBsJ87epGdFRWKhTGKYwCbaYid1nRs7%2BvQEU7MRYghok8KMTueELipohm3otuKo8V4a7w4TgTSBvPE%2BLPLJRwhM8KcjGlcpzF1NowRo6zeJJhbdPpouUH2NJzDcp7P4uUuUB9Cxt9B986My6zDnz1eyBvRMzj7TABfmfPFPoY3RfzBUzDm%2FA9lOGsM6d9WZj2CH0WxqiLDGmP1Ts9DWX%2FsYyqEGK5R1Xpnp7kRIarPtYliecp50ZIH6nqSkoCBllMCCE6JN%2BdoXobTpulALdmQV0%2Bppv%2FAjzIJrTHgX7jwRGEAeRgAxTomtemmIaH5NtV7xt8XS%2BqwghdJl1D06%2FWhpMtJ1%2FoQGoJ0%2F7ChYyefyAfsiQNWsO66UNVyl71RVPwATnbRO5K5mtxn0M2wuXXpAARNh6pQTcVX%2FTJ4jmosyKwhI6I870NEOsSaWlKVyOdb97C3Bt0pvzq8BagV5FMsNtJKmqIIM0HRkMkalIyfow9iS%2B5xGN5eKM8NE4E6hO4CvmpG%2BH2xFHTSNzloV0FjLdDmj5UfMjhUuEb3rkKK1bGAVaaherp6Ai6N4YJQzh%2FDdpo6al95EZN2OYolzxitgDgsWVGhMvddyQTwnRqRY04hdVJTwdhi4TiCPbLJ1Wcty2ozy6VDs4w77EOAQ5JnxUmDVPA3vXmADJZR0hIJEsuxXfYg%2BRIdV4fzGunV4%2B9jpiyM9G11iiesURK82o%2BdcG7FaCkkun2K2bvD6qGcL61uhoxNeLVpAxjrRjaEBrXsexZ9rExpMlFD8e3NM%2B0K0LQJvdEvpWYS5UTG9cAbNAzBs%3DpDsPXFGf2lEMcyGaK1ouARHUfqU0fzkeVwjXU9ORI%2Fs%3D")
if r: 
    print(r)
else: 
    print("KEY NOT FOUND :(")

Flask_SignedCookies 示例

x = Flask_SignedCookies()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("eyJoZWxsbyI6IndvcmxkIn0.XDtqeQ.1qsBdjyRJLokwRzJdzXMVCSyRTA")
if r: 
    print(r)
else: 
    print("KEY NOT FOUND :(")

Peoplesoft_PSToken 示例

x = Peoplesoft_PSToken()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("qAAAAAQDAgEBAAAAvAIAAAAAAAAsAAAABABTaGRyAk4AdQg4AC4AMQAwABSpxUdcNT67zqSLW1wY5/FHQd1U6mgAAAAFAFNkYXRhXHicHYfJDUBQAESfJY5O2iDWgwIsJxHcxdaApTvFGX8mefPmAVzHtizta2MSrCzsXBxcnOIt9yo6GvyekZqJmZaBPCUmVUMS2c9MjCmJKLSR/u+laUGuzwdaGw3o")
if r: 
    print(r)
else: 
    print("KEY NOT FOUND :(")

Django_SignedCookies 示例

x = Django_SignedCookies()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret(".eJxVjLsOAiEURP-F2hAuL8HSfr-BAPciq4ZNlt3K-O9KsoU2U8w5My8W4r7VsHdaw4zswoCdfrsU84PaAHiP7bbwvLRtnRMfCj9o59OC9Lwe7t9Bjb2OtbMkAEGQtQjekykmJy9JZIW-6CgUaCGsA6eSyV65s1Qya_xGKZrY-wPVYjdw:1ojOrE:bfOktjgLlUykwCIRIpvaTZRQMM3-UypscEN57ECtXis")
if r: 
    print(r)
else: 
    print("KEY NOT FOUND :(")

Rails_SecretKeyBase 示例

x = Rails_SecretKeyBase()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("dUEvRldLekFNcklGZ3ZSbU1XaHJ0ZGxsLzhYTHlNTW43T3BVN05kZXE3WUhQOVVKbVA3Rm5WaSs5eG5QQ1VIRVBzeDFNTnNpZ0xCM1FKbzFZTEJISzhaNzFmVGYzME0waDFURVpCYm5TQlJFRmRFclYzNUZhR3VuN29PMmlkVHBrRi8wb3AwZWgvWmxObkFOYnpkeHR1YWpWZ3lnN0Y4ZW9xSk9LNVlQd0U4MmFsbWtLZUI5VzkzRkM4YXBFWXBWLS15L00xME1nVFp2ZTlmUWcxZVlpelpnPT0=--7efe7919a5210cfd1ac4c6228e3ff82c0600d841")
if r: 
    print(r)
else: 
    print("KEY NOT FOUND :(")

Generic_JWT 示例

x = Generic_JWT()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo")
if r: 
    print(r)
else: 
    print("KEY NOT FOUND :(")

Telerik_EncryptionKey 示例

x = Telerik_EncryptionKey()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("owOnMokk%2F4N7IMo6gznRP56OYIT34dZ1Bh0KBbXlFgztgiNNEBYrgWRYDBkDlX8BIFYBcBztC3NMwoT%2FtNF%2Ff2nCsA37ORIgfBem1foENqumZvmcTpQuoiXXbMWW8oDjs270y6LDAmHhCRsl4Itox4NSBwDgMIOsoMhNrMigV7o7jlgU16L3ezISSmVqFektKmu9qATIXme63u4IKk9UL%2BGP%2Fk3NPv9MsTEVH1wMEf4MApH5KfWBX96TRIc9nlp3IE5BEWNMvI1Gd%2BWXbY5cSY%2Buey2mXQ%2BAFuXAernruJDm%2BxK8ZZ09TNsn5UREutvNtFRrePA8tz3r7p14yG756E0vrU7uBz5TQlTPNUeN3shdxlMK5Qzw1EqxRZmjhaRpMN0YZgmjIpzFgrTnT0%2Bo0f6keaL8Z9TY8vJN8%2BEUPoq%2F7AJiHKm1C8GNc3woVzs5mJKZxMUP398HwGTDv9KSwwkSpHeXFsZofbaWyG0WuNldHNzM%2FgyWMsnGxY6S086%2F477xEQkWdWG5UE%2FowesockebyTTEn3%2B%2FqiVy%2FIOxXvMpvrLel5nVY%2FSouHp5n2URRyRsfo%2B%2BOXJZo7yxKQoYBSSkmxdehJqKJmbgxNp5Ew8m89xAS5g99Hzzg382%2BxFp8yoDVZMOiTEuw0J%2B4G6KizqRW9cis%2FELd0aDE1V7TUuJnFrX%2BlCLOiv100tKpeJ0ePMOYrmvSn0wx7JhswNuj%2BgdKqvCnMSLakGWiOHxu5m9Qqdm3s5sk7nsaxMkh8IqV%2BSzB9A2K1kYEUlY40II1Wun67OSdLlYfdCFQk4ED0N%2BV4kES%2F1xpGiaPhxjboFiiV%2BkvCyJfkuotYuN%2B42CqFyAyepXPA%2BR5jVSThT6OIN2n1UahUnrD%2BwKKGMA9QpVPTSiGLen2KSnJtXISbrl2%2BA2AnQNH%2BMEwYVNjseM0%2BAosbgVfNde2ukMyugo%2FRfrRM27cbdVlE0ms0uXhlgKAYJ2ZN54w1tPWhpGxvZtB0keWpZan0YPh8CBgzsAIMa04HMYLCtgUTqxKqANoKXSy7VIJUzg3fl%2F2WUELjpXK9gRcgexNWDNB1E0rHd9PUo0PvpB4fxSrRpb1LRryipqsuoJ8mrpOVrVMvjracBvtoykK3GrN%2FDUlXkSG%2FAeBQN7HwDJ9QPi3AtEOohp78Op3nmbItXo7IJUSjzBNzUYR8YPj6Ud7Fje9LZSwMBngvgx%2BOKy6HsV4ofOAU2%2FK1%2BfxI0KkCeoSso9NJHWgBD7ijfXUa1Hrc%2FuNU3mTlSSVp3VStQrJ

Badsecrets 使用指南：检测Web框架中的敏感信息一、Badsecrets 概述 Badsecrets 是一个功能强大的 Python 代码库，专门用于从多种 Web 框架中检测已知的敏感信息。它基于纯 Python 开发，主要目标是识别在各种平台上使用已知或脆弱的加密敏感信息。核心特点作为"已知敏感信息"的存储库（如 ASP.NET 机器密钥等教程示例）提供与语言无关的抽象层来识别敏感信息的使用支持多种 Web 框架和技术的检测二、工具模块详解 Badsecrets 包含以下检测模块： | 模块名称 | 检测目标 | |---------|---------| | ASPNET_ Viewstate | 检查视图状态/生成器是否使用已知设备密钥 | | Telerik_ HashKey | 检查已修复的 Telerik UI(2017+)版本是否存在已知的 Telerik.Upload.ConfigurationHashKey | | Telerik_ EncryptionKey | 检查已修复的 Telerik UI(2017+)版本是否存在已知的 Telerik.Web.UI.DialogParametersEncryptionKey | | Flask_ SignedCookies | 检查 Flask Cookie 弱签名密码 | | Peoplesoft_ PSToken | 检查 Peoplesoft PS_ TOKEN 是否存在错误/弱签名密码 | | Django_ SignedCookies | 检查 Django 的会话 cookie(在 signed_ cookie 模式下)是否存在已知的 Django secret_ key | | Rails_ SecretKeyBase | 检查 Ruby on Rails 签名或加密的会话 cookie 是否存在已知的 secret_ key_ base | | Generic_ JWT | 检查 JWT 中已知的 HMAC 敏感信息或 RSA 私钥 | | Jsf_ viewstate | 检查 Java Server Faces(JSF)的 Mojarra 和 Myfaces 实现是否使用了已知或弱密钥 | | Symfony_ SignedURL | 检查 Symfony 的"_ fragment"url 中是否存在已知的 HMAC 密钥 | | Express_ SignedCookies_ ES | 检查 express.js 的 express 会话中间件的签名 cookie 和会话 cookie 的已知"会话机密" | | Express_ SignedCookies_ CS | 检查 express.js 的 cookie 会话中间件的签名 cookie 和会话 cookie 的已知机密 | | Laravel_ SignedCookies | 检查"laravel_ session"cookie 中是否存在已知的 Laravel "APP_ KEY" | | ASPNET_ Vstate | 检查自定义压缩的 Viewstate 代码段是否存在 RCE 漏洞 | 三、安装方法通过 Git 克隆通过 pip 安装四、基本使用方法 1. 命令行直接使用 2. 调用脚本使用 3. 命令行帮助信息输出：五、使用示例 1. 检查加密产品中的已知敏感信息(针对所有模块) 2. URL 模式下检测目标 3. 输出示例六、作为代码库使用 1. 导入模块 2. 各模块使用示例 ASPNET_ Viewstate 示例 Telerik_ HashKey 示例 Flask_ SignedCookies 示例 Peoplesoft_ PSToken 示例 Django_ SignedCookies 示例 Rails_ SecretKeyBase 示例 Generic_ JWT 示例 Telerik_ EncryptionKey 示例