Example: web-application

Inputs
Profile
Report outputs
- Triage report (converted from triage_report.json)
- CSV outputs

Inputs

examples/inputs/web-application-samples/config.json
examples/inputs/web-application-samples/vulnerable_java_app.java
examples/inputs/web-application-samples/vulnerable_php.php
examples/inputs/web-application-samples/vulnerable_python.py

Profile

# Web Application Profile
# Profile for analyzing web applications (Java, Python, Node.js, etc.)

decode = ["base64", "hex", "percent-encoding", "html-entity", "unicode-escape-sequences"]

max-file-size = 52428800  # 50 MiB

include-path-globs = [
  "**/*.java", "**/*.class", "**/*.jar", "**/*.war", "**/*.ear",
  "**/*.py", "**/*.pyc",
  "**/*.js", "**/*.ts", "**/*.jsx", "**/*.tsx",
  "**/*.php",
  "**/*.rb",
  "**/*.go",
  "**/*.jsp", "**/*.jspx",
  "**/*.html", "**/*.htm",
  "**/*.xml", "**/*.json", "**/*.yaml", "**/*.yml",
  "**/*.config", "**/*.conf", "**/*.properties", "**/*.env"
]

exclude-path-globs = [
  "**/node_modules/**",
  "**/vendor/**",
  "**/.git/**",
  "**/venv/**",
  "**/__pycache__/**",
  "**/target/**",
  "**/build/**",
  "**/dist/**"
]

tag = "web-app"

# SQL Injection Indicators
[[patterns]]
  name = "SQL Statement"
  pattern = "(?:(?:select\\s+\\S.*\\s+from\\s+\\S+)|(?:insert\\s+into\\s+\\S+)|(?:update\\s+\\S+\\s+set\\s+\\S+)|(?:delete\\s+from\\s+\\S+))"
  case-insensitive = true
  type = "regex"

[[patterns]]
  name = "String Concatenation SQL"
  pattern = "\\+\\s*['\"].*\\s+(AND|OR|WHERE|FROM|SELECT)\\s+"
  type = "regex"
  case-insensitive = true

# Command Injection Indicators
[[patterns]]
  name = "Java Exec"
  pattern = "Runtime\\.getRuntime\\(\\)\\.exec\\("
  type = "regex"

[[patterns]]
  name = "Python os.system"
  pattern = "os\\.system\\("
  type = "regex"

[[patterns]]
  name = "PHP system/exec"
  pattern = "(system|exec|shell_exec|passthru|popen)\\s*\\("
  type = "regex"

# Deserialization Indicators
[[patterns]]
  name = "Java Deserialization"
  pattern = "ObjectInputStream|readObject\\("
  type = "regex"

[[patterns]]
  name = "Python Pickle"
  pattern = "pickle\\.(load|loads)\\("
  type = "regex"

[[patterns]]
  name = "PHP Unserialize"
  pattern = "unserialize\\s*\\("
  type = "regex"

# Path Traversal
[[patterns]]
  name = "Path Traversal"
  pattern = "\\.\\./|\\.\\.%2[fF]|\\.\\.\\\\|%2[eE]%2[eE]%2[fF]"
  type = "regex"

# XSS Indicators
[[patterns]]
  name = "Script Tag"
  pattern = "<script[^>]*>.*</script>"
  type = "regex"
  case-insensitive = true

[[patterns]]
  name = "Event Handler"
  pattern = "on(click|load|error|mouseover|focus|blur)\\s*="
  type = "regex"
  case-insensitive = true

# Sensitive Data
[[patterns]]
  name = "Debug/Test Credentials"
  pattern = "(debug|test|admin|root)_(password|passwd|pwd|key|secret)"
  type = "regex"
  case-insensitive = true

[[patterns]]
  name = "Hardcoded Secret"
  pattern = "(secret|token|api_key)\\s*=\\s*['\"][^'\"]{8,}['\"]"
  type = "regex"
  case-insensitive = true

# JWT Tokens
[[patterns]]
  name = "JWT Token"
  pattern = "eyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+"
  type = "regex"

# Request Handling
[[patterns]]
  name = "Request Parameter"
  pattern = "request\\.getParameter\\(|request\\.GET\\[|\\$_GET\\[|\\$_POST\\[|request\\.form\\["
  type = "regex"

# Signatures
[[signatures]]
  name = "Files with SQL and Parameter Access"
  query = "SELECT DISTINCT sha256 FROM pattern_matches WHERE pattern_name = 'SQL Statement' AND sha256 IN (SELECT sha256 FROM pattern_matches WHERE pattern_name = 'Request Parameter')"

[[signatures]]
  name = "Files with Multiple Security Issues"
  query = "SELECT sha256, COUNT(DISTINCT pattern_name) as issue_count FROM pattern_matches GROUP BY sha256 HAVING issue_count > 5"

Report outputs

Triage report (converted from triage_report.json)

total_files	5
critical_count	0
high_count	0
medium_count	0
low_count	4
minimal_count	1
must_investigate_count	0
all_scores	None
generated_at	2025-12-03T09:19:43.744986639+00:00

top_scores

file_type	file_type_score	must_investigate	path	pattern_count_score	pattern_matches	pattern_severity_score	reasons	risk_level	score	sha256
Script	20	False	/vulnerable_python.py	15	19	14	["19 suspicious patterns detected"]	Low	49	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146
Other	0	False	/vulnerable_php.php	20	27	16	["27 suspicious patterns detected"]	Low	36	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07
Other	0	False	/vulnerable_java_app.java/vulnerable_java_app.java.percent-encoding	20	26	16	["26 suspicious patterns detected"]	Low	36	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613
Other	0	False	/vulnerable_java_app.java	20	26	16	["26 suspicious patterns detected"]	Low	36	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec
Other	0	False	/config.json	5	3	5	["3 suspicious patterns detected"]	Minimal	10	6716179e4ba5df26510403251df99b01c4fb98437e609bc6411982681662b20e

CSV outputs

errors.csv

Empty CSV

files.csv

path	file_name	sha256	file_created	file_modified	file_accessed	mime_types_from_file_extension	is_decoded_file
/config.json	config.json	6716179e4ba5df26510403251df99b01c4fb98437e609bc6411982681662b20e	2025-12-03T08:56:20.497889219Z	2025-12-03T08:56:20.497889219Z	2025-12-03T08:56:20.497889219Z	["application/feed+json"]	0
/vulnerable_php.php	vulnerable_php.php	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	2025-12-03T08:56:20.497889219Z	2025-12-03T08:56:20.497889219Z	2025-12-03T08:56:20.497889219Z	[]	0
/vulnerable_python.py	vulnerable_python.py	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	2025-12-03T08:56:20.497889219Z	2025-12-03T08:56:20.497889219Z	2025-12-03T08:56:20.497889219Z	["text/x-script.python"]	0
/vulnerable_java_app.java/vulnerable_java_app.java.percent-encoding	vulnerable_java_app.java.percent-encoding	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613				[]	1
/vulnerable_java_app.java	vulnerable_java_app.java	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	2025-12-03T08:56:20.497889219Z	2025-12-03T08:56:20.497889219Z	2025-12-03T08:56:20.497889219Z	[]	0

pattern_matches.csv

id	sha256	pattern_name	match_type	match	location	length
1	6716179e4ba5df26510403251df99b01c4fb98437e609bc6411982681662b20e	Debug/Test Credentials	regex	admin_password	4:5	14
2	6716179e4ba5df26510403251df99b01c4fb98437e609bc6411982681662b20e	Debug/Test Credentials	regex	test_key	5:5	8
3	6716179e4ba5df26510403251df99b01c4fb98437e609bc6411982681662b20e	JWT Token	regex	eyJhbGciOiJIUzI1NiJ9.eyJSb2xlIjoiQWRtaW4ifQ.fake_jwt_token_here	11:19	63
4	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	SQL Statement	regex	SELECT * FROM users	15:10	19
5	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	SQL Statement	regex	SELECT name FROM users	16:13	22
6	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	PHP system/exec	regex	system(	7:0	7
7	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	PHP system/exec	regex	exec(	8:0	5
8	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	PHP system/exec	regex	shell_exec(	9:0	11
9	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	PHP system/exec	regex	passthru(	10:0	9
10	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	PHP system/exec	regex	popen(	11:0	6
11	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	PHP Unserialize	regex	unserialize(	20:7	12
12	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Path Traversal	regex	../	23:9	3
13	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Path Traversal	regex	../	23:12	3
14	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Path Traversal	regex	../	23:15	3
15	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Script Tag	regex	<script>alert('XSS')</script>	27:6	29
16	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Event Handler	regex	onclick=	28:12	8
17	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Event Handler	regex	onerror=	34:17	8
18	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Event Handler	regex	onmouseover=	35:9	12
19	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Event Handler	regex	onfocus=	36:11	8
20	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Debug/Test Credentials	regex	admin_secret	48:1	12
21	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Debug/Test Credentials	regex	admin_password	48:30	14
22	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Hardcoded Secret	regex	api_key = "sk-abcdef1234567890abcdef1234567890"	47:1	47
23	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Hardcoded Secret	regex	secret = "super_secret_admin_password_123"	48:7	42
24	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Request Parameter	regex	$_GET[	6:7	6
25	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Request Parameter	regex	$_POST[	8:5	7
26	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Request Parameter	regex	$_GET[	9:19	6
27	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Request Parameter	regex	$_GET[	11:6	6
28	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Request Parameter	regex	$_GET[	14:6	6
29	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Request Parameter	regex	$_GET[	19:8	6
30	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	Request Parameter	regex	$_GET[	24:8	6
31	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	SQL Statement	regex	SELECT * FROM users	16:13	19
32	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	SQL Statement	regex	INSERT INTO audit_log	18:14	21
33	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	SQL Statement	regex	UPDATE settings SET value	19:14	25
34	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	SQL Statement	regex	DELETE FROM temp	20:14	16
35	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	String Concatenation SQL	regex	+ "' WHERE	19:69	11
36	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Python os.system	regex	os.system(	28:4	10
37	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	PHP system/exec	regex	system(	28:7	7
38	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Python Pickle	regex	pickle.loads(	37:10	13
39	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Path Traversal	regex	../	44:12	3
40	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Path Traversal	regex	../	44:15	3
41	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Path Traversal	regex	../	44:18	3
42	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Debug/Test Credentials	regex	test_password	50:0	13
43	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Debug/Test Credentials	regex	admin_key	51:0	9
44	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Hardcoded Secret	regex	TOKEN = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4ifQ.fake"	49:4	74
45	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	JWT Token	regex	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4ifQ.fake	49:13	64
46	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Request Parameter	regex	request.form[	15:14	13
47	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Request Parameter	regex	request.form[	18:49	13
48	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Request Parameter	regex	request.form[	19:47	13
49	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	Request Parameter	regex	request.form[	20:51	13
50	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	SQL Statement	regex	SELECT * FROM users	18:24	19
51	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	SQL Statement	regex	INSERT INTO logs	20:30	16
52	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	SQL Statement	regex	UPDATE users SET name	21:30	21
53	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	SQL Statement	regex	DELETE FROM sessions	22:30	20
54	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	String Concatenation SQL	regex	+ "' WHERE	21:88	11
55	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Java Exec	regex	Runtime.getRuntime().exec(	26:8	26
56	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	PHP system/exec	regex	exec(	26:29	5
57	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Java Deserialization	regex	ObjectInputStream	29:8	17
58	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Java Deserialization	regex	ObjectInputStream	29:36	17
59	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Java Deserialization	regex	readObject(	30:25	11
60	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Path Traversal	regex	../	33:23	3
61	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Path Traversal	regex	../	33:26	3
62	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Path Traversal	regex	../	33:29	3
63	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Path Traversal	regex	../	34:30	3
64	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Path Traversal	regex	../	34:33	3
65	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Path Traversal	regex	../	34:36	3
66	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Script Tag	regex	<script>alert('XSS')</script>	37:38	29
67	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Debug/Test Credentials	regex	debug_password	42:15	14
68	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Debug/Test Credentials	regex	test_secret	43:15	11
69	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Hardcoded Secret	regex	secret = "sk-12345678abcdefghijklmnopqrstuvwxyz12345678"	40:15	56
70	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Hardcoded Secret	regex	token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"	41:15	165
71	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Hardcoded Secret	regex	secret = "very_secret_value_12345678"	43:20	37
72	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	JWT Token	regex	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c	41:24	155
73	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Request Parameter	regex	request.getParameter(	17:24	21
74	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Request Parameter	regex	request.getParameter(	21:59	21
75	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	Request Parameter	regex	request.getParameter(	25:26	21
76	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	SQL Statement	regex	SELECT * FROM users	18:24	19
77	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	SQL Statement	regex	INSERT INTO logs	20:30	16
78	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	SQL Statement	regex	UPDATE users SET name	21:30	21
79	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	SQL Statement	regex	DELETE FROM sessions	22:30	20
80	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	String Concatenation SQL	regex	+ "' WHERE	21:88	11
81	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Java Exec	regex	Runtime.getRuntime().exec(	26:8	26
82	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	PHP system/exec	regex	exec(	26:29	5
83	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Java Deserialization	regex	ObjectInputStream	29:8	17
84	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Java Deserialization	regex	ObjectInputStream	29:36	17
85	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Java Deserialization	regex	readObject(	30:25	11
86	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Path Traversal	regex	../	33:23	3
87	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Path Traversal	regex	../	33:26	3
88	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Path Traversal	regex	../	33:29	3
89	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Path Traversal	regex	..%2F	34:30	5
90	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Path Traversal	regex	..%2F	34:35	5
91	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Path Traversal	regex	..%2F	34:40	5
92	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Script Tag	regex	<script>alert('XSS')</script>	37:38	29
93	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Debug/Test Credentials	regex	debug_password	42:15	14
94	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Debug/Test Credentials	regex	test_secret	43:15	11
95	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Hardcoded Secret	regex	secret = "sk-12345678abcdefghijklmnopqrstuvwxyz12345678"	40:15	56
96	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Hardcoded Secret	regex	token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"	41:15	165
97	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Hardcoded Secret	regex	secret = "very_secret_value_12345678"	43:20	37
98	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	JWT Token	regex	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c	41:24	155
99	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Request Parameter	regex	request.getParameter(	17:24	21
100	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Request Parameter	regex	request.getParameter(	21:59	21
101	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	Request Parameter	regex	request.getParameter(	25:26	21

signature_matches.csv

id	signature_name	sha256
1	Files with SQL and Parameter Access	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07
2	Files with SQL and Parameter Access	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146
3	Files with SQL and Parameter Access	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613
4	Files with SQL and Parameter Access	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec
5	Files with Multiple Security Issues	22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613
6	Files with Multiple Security Issues	63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146
7	Files with Multiple Security Issues	b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec
8	Files with Multiple Security Issues	c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07

unique_files.csv

sha256	sha1	md5	file_size	mime_type_for_content	shannon_entropy
c849e87dc3f933873149e29c3f6994fbc6ffba3d11b8b95a1daed2e7705d7d07	7368496e62dd8d28503c3814db65960af614fd1e	f3dfab8692c93a4e183662e5ec2b6f43	1244	text/plain	5.44631782671462
6716179e4ba5df26510403251df99b01c4fb98437e609bc6411982681662b20e	d97f38cb21b2c4b7c4ac8e6a8ba869a217e42e60	7b1bb4fb223bdeede54eb9365d5604f5	537	text/plain	5.1543776756198
63ee97c23b49baa9e28017e8e65e3d6f2bba43722a17d77eb2b737fcce3ca146	0ebd6dd0d2a74593975af8427b5932e3e0748643	5c3d56a8fa0294cfd04498374a6bded3	1526	text/x-script.python	5.29739365190587
22308e535c62c1c6a999e772634e1ea58c91a8819490fcb874d0dfc72d9c3613	a2fa6a23d14dc32ff9eb45425066d2713a1f9d2d	9761a1a42f7f9ed8648ce1d95788acd9	1905	text/plain	5.06993651800799
b4fb727b949c9f36e108b866d31bb0375941f7665b0e4e4d3007bd2add5621ec	d3726f5382b1ff1e4ce4b84a08a995424e385fb0	2a81b315730471ecbd4531b174af1e85	1913	text/plain	5.09000925146894

Keyboard shortcuts

sus - Systematic Universal Scanner - Documentation