Tenable WAS 114129 — Generic Secret Disclosure (hardcoded credentials in client-side web assets)

#!/usr/bin/env python3
# noisgate — verify Tenable WAS 114129 (Generic Secret Disclosure) exposure
# Usage: python check_secret_disclosure.py <base_url>
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
import re, sys, urllib.parse as up
try:
    import requests
except ImportError:
    print('UNKNOWN: install requests (pip install requests)'); sys.exit(2)

if len(sys.argv) != 2:
    print('UNKNOWN: usage: check_secret_disclosure.py <base_url>'); sys.exit(2)

BASE = sys.argv[1].rstrip('/')
HEADERS = {'User-Agent': 'noisgate-secret-check/1.0'}
TIMEOUT = 15

# High-signal secret patterns. Extend as needed.
PATTERNS = {
    'AWS access key':          re.compile(r'AKIA[0-9A-Z]{16}'),
    'AWS secret key':          re.compile(r'(?i)aws(.{0,20})?[\'"][0-9a-zA-Z/+]{40}[\'"]'),
    'GitHub PAT (classic)':    re.compile(r'ghp_[0-9A-Za-z]{36}'),
    'GitHub fine-grained':     re.compile(r'github_pat_[0-9A-Za-z_]{82}'),
    'GitHub OAuth':            re.compile(r'gho_[0-9A-Za-z]{36}'),
    'Slack bot/user token':    re.compile(r'xox[baprs]-[0-9A-Za-z-]{10,}'),
    'Stripe live secret':      re.compile(r'sk_live_[0-9a-zA-Z]{24,}'),
    'Google API key':          re.compile(r'AIza[0-9A-Za-z_\-]{35}'),
    'Twilio SID':              re.compile(r'AC[0-9a-f]{32}'),
    'SendGrid API key':        re.compile(r'SG\.[0-9A-Za-z_\-]{22}\.[0-9A-Za-z_\-]{43}'),
    'PEM private key':         re.compile(r'-----BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY-----'),
    'JWT':                     re.compile(r'eyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}'),
    'Generic bearer secret':   re.compile(r'(?i)(secret|token|api[_-]?key|passwd|password)[\'"\s:=]{1,5}[\'"][A-Za-z0-9_\-]{24,}[\'"]'),
}

def fetch(url):
    try:
        r = requests.get(url, headers=HEADERS, timeout=TIMEOUT, allow_redirects=True)
        return r.text if r.status_code == 200 else ''
    except Exception:
        return ''

def scan(text, source):
    hits = []
    for name, pat in PATTERNS.items():
        for m in pat.findall(text)[:3]:
            snippet = m if isinstance(m, str) else str(m)
            hits.append((source, name, snippet[:80]))
    return hits

html = fetch(BASE)
if not html:
    print(f'UNKNOWN: could not fetch {BASE}'); sys.exit(2)

findings = scan(html, BASE)

# Extract linked JS + sourcemaps
js_urls = set(re.findall(r'<script[^>]+src=["\']([^"\']+\.js[^"\']*)', html, re.I))
for js in list(js_urls)[:25]:  # cap to keep runtime bounded
    full = up.urljoin(BASE + '/', js)
    body = fetch(full)
    findings += scan(body, full)
    m = re.search(r'//[#@]\s*sourceMappingURL=(\S+)', body)
    if m:
        smap = up.urljoin(full, m.group(1))
        findings += scan(fetch(smap), smap)

if findings:
    print('VULNERABLE: potential secret disclosure detected')
    for src, name, sample in findings[:20]:
        print(f'  [{name}] {src} :: {sample}')
    sys.exit(1)
print('PATCHED: no matching secret patterns in fetched surface')
sys.exit(0)