Leet Speak Translater

[bplaxco]

Goal

Avoid needing to ignore common leet speak variants in scanners for likely placeholder passwords.

Idea

Create a reference implementation for taking a false positive indicator for generic placeholder values and integrating a leet speak translator to handle things like P4ssw0rd Pa$$w0rd, etc.

Needing Research

How to do this without accidentally ignoring true positives (e.g. What if B6lX2DTqclfp4550rdszm5Ov1IaClhVlbwUi-La-YS714XmCk was there and the translator thought p4550rd was password in leet speak?).

[rgmz]

@bplaxco This would be the opposite of Gitleak's codecs, right? Or do you want to compile a static word list?

[bplaxco]

@rgmz I don't know that it it would be the opposite of Gitleak's codecs but kinda similar but maybe further down in the pipeline after a thing's already been detected, but when we're evaluating if it should be dropped.

So like after we've already detected password="Pa$$0rD" have something go in and attempt a normal leet-speek translator to see if that'd make sense as password.

I don't think it'd need to be a huge list of words, probably just a series of replaces and sanitation steps was what I'm thinking.

$ -> s
4 -> a
0 -> o
upper -> lower
...

But yeah part of the research bit would be figuring out what are the most common false positives caused by people doing things like that and figuring out the most efficient way to do all the changes ^_^.

I have a data set of FPs that I could probably generate some stats from to contribute to this.