generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash
Community Favorite

Author
37,965
Download Count*
License
bcrypt hash detected
Run Locally
Run in CI
Defintion
rules:
- id: detected-bcrypt-hash
pattern-regex: \$2[aby]?\$[\d]+\$[./A-Za-z0-9]{53}
languages:
- regex
message: bcrypt hash detected
severity: ERROR
metadata:
cwe:
- "CWE-798: Use of Hard-coded Credentials"
category: security
technology:
- secrets
- bcrypt
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Commons Clause License Condition v1.0[LGPL-2.1-only]
vulnerability_class:
- Hard-coded Secrets
Examples
detected-bcrypt-hash.txt
--
-- Dumping data for table `users`
--
INSERT INTO `users` (`user_id`, `username`, `password`, `flag`) VALUES
# ruleid: detected-bcrypt-hash
(1, 'rogers63', '$2y$12$s.YfVZdfvAuO/Iz6fte5iO..ZbbEgreZnDcYOGvX4NGJskYQIstcG', 1),
Short Link: https://sg.run/3A8G