Detector: Azure SAS Token and Publish Profile

[ankushgoel27]

It would be nice to also detect SAS Tokens and Azure publish Profiles. SAS tokens basically give access to azure storage containers and publish profile also contain sensitive credentials.

[rgmz]

@ankushgoel27 mind sharing some examples for both?

[ankushgoel27]

@rgmz Here are some examples of the publish profile
<publishData><publishProfile profileName="lbxFaasTest-Head-1 - Web Deploy" publishMethod="MSDeploy" publishUrl="lbxfaastest-head-1.scm.azurewebsites.net:443" msdeploySite="lbxFaasTest-Head-1" userName="$lbxFaasTest-Head-1" userPWD="GZPlxk6TAPl49QMgQTrfmmKtt1ToQABkZd8zswqhXHtWGW4KT049FTsuHz8l" destinationAppUrl="https://lbxfaastest-head-1.azurewebsites.net" SQLServerDBConnectionString="" mySQLDBConnectionString="" hostingProviderForumLink="" controlPanelLink="http://windows.azure.com" webSystem="WebSites"><databases /></publishProfile><publishProfile profileName="lbxFaasTest-Head-1 - FTP" publishMethod="FTP" publishUrl="ftps://waws-prod-sy3-091.ftp.azurewebsites.windows.net/site/wwwroot" ftpPassiveMode="True" userName="lbxFaasTest-Head-1\$lbxFaasTest-Head-1" userPWD="GZPlxk6TAPl49QMgQTrfmmKtt1ToQABkZd8zswqhXHtWGW4KT049FTsuHz8l" destinationAppUrl="https://lbxfaastest-head-1.azurewebsites.net" SQLServerDBConnectionString="" mySQLDBConnectionString="" hostingProviderForumLink="" controlPanelLink="http://windows.azure.com" webSystem="WebSites"><databases /></publishProfile><publishProfile profileName="lbxFaasTest-Head-1 - Zip Deploy" publishMethod="ZipDeploy" publishUrl="lbxfaastest-head-1.scm.azurewebsites.net:443" userName="$lbxFaasTest-Head-1" userPWD="GZPlxk6TAPl49QMgQTrfmmKtt1ToQABkZd8zswqhXHtWGW4KT049FTsuHz8l" destinationAppUrl="https://lbxfaastest-head-1.azurewebsites.net" SQLServerDBConnectionString="" mySQLDBConnectionString="" hostingProviderForumLink="" controlPanelLink="http://windows.azure.com" webSystem="WebSites"><databases /></publishProfile></publishData>

I think this is the general format of the SAS token

?sv={service-version}&ss={services}&srt={resource-types}&sp={permissions}&se={expiry-time}&st={start-time}&spr={protocol}&sig={signature}

example from real world - https://testprod.blob.core.windows.net/testproddocs/83df11f0%2F82254ece%2F9f233cd6%2F4211b2ee%2Fdceb565a%2Fb9aab974%2F60d98dc7%2F9e29ab10?sv=2020-10-02&se=2023-03-27T08%3A55%3A32Z&sr=b&sp=r&sig=mMnfgASjqMNp%2F2c7IT%2B%2Fnz0uwg%2FoynmmUjXQAlTnnWs%3D&rscd=inline