91 lines
3.0 KiB
Bash
91 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
|
# ©AngelaMos | 2026
|
|
# validate.sh
|
|
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
BOLD='\033[1m'
|
|
NC='\033[0m'
|
|
|
|
PASS=0
|
|
FAIL=0
|
|
|
|
check() {
|
|
local label="$1"
|
|
local pattern="$2"
|
|
if echo "$OUTPUT" | grep -qi "$pattern"; then
|
|
echo -e " ${GREEN}+${NC} $label"
|
|
PASS=$((PASS + 1))
|
|
else
|
|
echo -e " ${RED}x${NC} $label"
|
|
FAIL=$((FAIL + 1))
|
|
fi
|
|
}
|
|
|
|
echo -e "\n${BOLD}Running credenum...${NC}\n"
|
|
|
|
OUTPUT=$(credenum --target /home/testuser --format json 2>&1) || true
|
|
|
|
echo -e "${BOLD}Terminal output:${NC}\n"
|
|
credenum --target /home/testuser 2>&1 || true
|
|
|
|
echo -e "\n${BOLD}Validating findings across all 7 categories...${NC}\n"
|
|
|
|
echo -e "${BOLD}[ssh]${NC}"
|
|
check "SSH unprotected private key" "no passphrase"
|
|
check "SSH encrypted private key" "passphrase-protected"
|
|
check "SSH config weak settings" "PasswordAuthentication"
|
|
check "SSH authorized keys" "authorized public keys"
|
|
check "SSH known hosts" "known hosts"
|
|
|
|
echo -e "\n${BOLD}[cloud]${NC}"
|
|
check "AWS credentials with static keys" "static keys"
|
|
check "AWS config profiles" "profiles"
|
|
check "GCP service account" "service_account"
|
|
check "Kubernetes config" "contexts"
|
|
|
|
echo -e "\n${BOLD}[browser]${NC}"
|
|
check "Firefox stored logins" "Firefox stored logins"
|
|
check "Firefox cookies" "Firefox cookies"
|
|
check "Firefox key database" "Firefox key"
|
|
check "Chromium login data" "google-chrome.*login"
|
|
|
|
echo -e "\n${BOLD}[history]${NC}"
|
|
check "History secret pattern" "Secret in shell history"
|
|
check "Sensitive command (curl auth)" "curl.*authoriz"
|
|
check "Sensitive command (sshpass)" "sshpass"
|
|
check "Environment file" "Environment file"
|
|
|
|
echo -e "\n${BOLD}[keyring]${NC}"
|
|
check "GNOME Keyring" "GNOME Keyring"
|
|
check "KeePass database" "KeePass"
|
|
check "Password store" "password-store"
|
|
|
|
echo -e "\n${BOLD}[git]${NC}"
|
|
check "Git credentials plaintext" "Plaintext Git credential"
|
|
check "Git credential helper" "credential helper"
|
|
check "GitHub token" "GitHub.*token"
|
|
|
|
echo -e "\n${BOLD}[apptoken]${NC}"
|
|
check "PostgreSQL pgpass" "PostgreSQL"
|
|
check "MySQL config" "MySQL"
|
|
check "Docker registry auth" "Docker.*auth"
|
|
check "Netrc credential file" "Netrc credential"
|
|
check "npm auth token" "npm registry"
|
|
check "PyPI credentials" "PyPI.*credentials"
|
|
check "GitHub CLI OAuth token" "GitHub CLI"
|
|
check "Vault token" "Vault token"
|
|
|
|
echo ""
|
|
echo -e "${BOLD}Results: ${GREEN}${PASS} passed${NC}, ${RED}${FAIL} failed${NC}"
|
|
echo ""
|
|
|
|
if [ "$FAIL" -gt 0 ]; then
|
|
echo -e "${RED}VALIDATION FAILED${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
echo -e "${GREEN}ALL CHECKS PASSED${NC}"
|