File protocol templates

id: basic-file-scan

info:
  name: Basic File Scan
  author: pdteam
  severity: info

file:
  - extensions:
      - txt
      - log
    
    matchers:
      - type: word
        words:
          - "password"
          - "secret"

id: aws-keys-file

info:
  name: AWS Access Keys in Files
  author: pdteam
  severity: high
  description: Detects exposed AWS access keys in local files

file:
  - extensions:
      - all
    
    matchers:
      - type: regex
        regex:
          - "(?i)aws(.{0,20})?['\"][0-9a-zA-Z\\/+]{40}['\"]" 

id: private-keys-file

info:
  name: Private Key Detection
  author: pdteam
  severity: critical
  description: Detects private keys in local files

file:
  - extensions:
      - all
    
    matchers:
      - type: word
        words:
          - "BEGIN RSA PRIVATE KEY"
          - "BEGIN DSA PRIVATE KEY"
          - "BEGIN EC PRIVATE KEY"
          - "BEGIN OPENSSH PRIVATE KEY"
          - "BEGIN PGP PRIVATE KEY"
        condition: or

id: env-file-secrets

info:
  name: Environment File Secrets
  author: pdteam
  severity: high
  description: Scans .env files for sensitive information

file:
  - extensions:
      - .env
      - env
    
    extractors:
      - type: regex
        name: database_credentials
        regex:
          - "DB_PASSWORD=(.+)"
          - "DATABASE_URL=(.+)"
        group: 1
      
      - type: regex
        name: api_keys
        regex:
          - "API_KEY=(.+)"
          - "SECRET_KEY=(.+)"
        group: 1

id: config-file-scan

info:
  name: Configuration File Scanner
  author: pdteam
  severity: medium
  description: Scans configuration files for sensitive data

file:
  - extensions:
      - .yml
      - .yaml
      - .json
      - .xml
      - .conf
      - .config
    
    max-size: 5MB
    
    matchers:
      - type: regex
        regex:
          - "password\\s*[:=]\\s*[^\\s]+"
          - "api[_-]?key\\s*[:=]\\s*[^\\s]+"
          - "secret\\s*[:=]\\s*[^\\s]+"
        condition: or

id: source-code-secrets

info:
  name: Secrets in Source Code
  author: pdteam
  severity: high
  description: Detects hardcoded secrets in source code

file:
  - extensions:
      - .py
      - .js
      - .java
      - .go
      - .php
      - .rb
    
    denylist:
      - node_modules/
      - vendor/
      - .git/
    
    matchers:
      - type: regex
        regex:
          - "(?i)(password|passwd|pwd)\\s*=\\s*[\"'](.+?)[\"
']"
          - "(?i)api[_-]?key\\s*=\\s*[\"'](.+)[\"']"
        condition: or

matchers:
  # Word matcher
  - type: word
    words:
      - "api_key"
      - "secret_token"
    condition: or
  
  # Regex matcher
  - type: regex
    regex:
      - "[a-zA-Z0-9]{32}"
  
  # Binary matcher
  - type: binary
    binary:
      - "504B0304"  # ZIP signature

extractors:
  # Regex extraction
  - type: regex
    name: credentials
    regex:
      - 'password="(.+?)"'
    group: 1
  
  # All matches
  - type: regex
    name: all_secrets
    regex:
      - "(?i)(password|secret|key)\\s*[:=]\\s*(.+)"

# Scan current directory
nuclei -t file-template.yaml -target .

# Scan specific directory
nuclei -t file-template.yaml -target /path/to/project

# Scan multiple directories
echo "/path/to/dir1" | nuclei -t file-template.yaml
echo "/path/to/dir2" | nuclei -t file-template.yaml