Skip to content

Instantly share code, notes, and snippets.

@MantisSTS
Created April 5, 2019 09:36
Show Gist options
  • Save MantisSTS/e5aa7dd47766aafa6d1c68a5c10b395d to your computer and use it in GitHub Desktop.
Save MantisSTS/e5aa7dd47766aafa6d1c68a5c10b395d to your computer and use it in GitHub Desktop.
Find High Entropy Strings ( functions from truffleHog )
import sys
import math
def get_strings_of_set(word, char_set, threshold=20):
count = 0
letters = ""
strings = []
for char in word:
if char in char_set:
letters += char
count += 1
else:
if count > threshold:
strings.append(letters)
letters = ""
count = 0
if count > threshold:
strings.append(letters)
return strings
BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
HEX_CHARS = "1234567890abcdefABCDEF"
class bcolors:
HEADER = '\033[95m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
FAIL = '\033[91m'
ENDC = '\033[0m'
BOLD = '\033[1m'
UNDERLINE = '\033[4m'
def shannon_entropy(data, iterator):
"""
Borrowed from http://blog.dkbza.org/2007/05/scanning-data-for-entropy-anomalies.html
"""
if not data:
return 0
entropy = 0
for x in iterator:
p_x = float(data.count(x))/len(data)
if p_x > 0:
entropy += - p_x*math.log(p_x, 2)
return entropy
for line in sys.stdin:
for word in line.split():
base64_strings = get_strings_of_set(word, BASE64_CHARS)
hex_strings = get_strings_of_set(word, HEX_CHARS)
for string in base64_strings:
b64Entropy = shannon_entropy(string, BASE64_CHARS)
if b64Entropy > 4.5:
line = line.replace(string, bcolors.WARNING + string + bcolors.ENDC)
print(line)
for string in hex_strings:
hexEntropy = shannon_entropy(string, HEX_CHARS)
if hexEntropy > 3:
line = line.replace(string, bcolors.WARNING + string + bcolors.ENDC)
print(line)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment