Catch Azure SAS tokens in URLs? about ripsecrets HOT 2 CLOSED

I think this one is tricky since the researchers intended to share the link, they just messed up the privileges on the link that they shared. There are tools that can try to detect this, but they're what I'd call "active scanners", meaning they actually reach out and try to make requests to the URLs and try to determine if they're over-provisioned. However ripsecrets is intentionally not an active scanner since that opens up a huge surface area of potentially vulnerabilities that just haven't yet been exploited in other secret scanning tools :-)

from ripsecrets.

Some more resources:

https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas#specify-the-access-policy

https://adamtheautomator.com/azure-sas-token/

https://improvado.io/docs/how-to-generate-an-azure-sas-token

I think the challenge here is that it's effectively a set of URL query parameters and they could be in any order.

It looks like from the screenshots I'm seeing of tokens and tables that there are

sv ss srt sp se sr st spr sig

query parameters, and these are required:

sv sig

and some others that may be required:

se sp sr

It seems like it might be OK to look for core.windows.net on the same line but that then binds tightly to the public Azure storage…

from ripsecrets.