credit-card-number-detect: Credit and Debit Card Number - Detection

id: credit-card-number-detect

info:
  name: Credit and Debit Card Number - Detection
  author: spiderSilk,morsy,geeknik
  severity: medium
  description: |
    This template is designed to identify the presence of credit or debit card numbers exposed within web pages, APIs, or other application responses. It searches for patterns matching card numbers using regular expressions aligned with common card formats, including Visa, MasterCard, American Express, and Discover cards. Detecting exposed card information can help identify potential compliance issues with standards like PCI DSS and mitigate risks of data leaks.
  reference:
    - https://www.tenable.com/plugins/was/98129
    - https://en.wikipedia.org/wiki/Payment_card_number
    - https://stackoverflow.com/questions/9315647/regex-credit-card-number-tests
  tags: credit,debit,card,payment,security,pci,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "\\b4[0-9]{12}(?:[0-9]{3})?\\b"
          - "\\b3[47][0-9]{13}\\b"
          - "\\b5[1-5][0-9]{14}\\b|\\b(222[1-9]|22[3-9]\\d|2[3-6]\\d{2}|27[0-1]\\d|2720)[0-9]{12}\\b"
          - "\\b65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})\\b"
          - "\\b(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}\\b"
          - "\\b62[0-9]{14,17}\\b"
          - "\\b3(?:0[0-5]|[68][0-9])[0-9]{11}\\b"
          - "\\b(?:2131|1800|35\\d{3})\\d{11}\\b"
        condition: or

      - type: status
        status:
          - 200

      - type: regex
        part: body
        regex:
          - "(?i)(card.{1,15}number|credit.{1,15}card.{1,15}number|debit.{1,15}card.{1,15}number)"
          - "(?i)(cvv|cvc|card.{1,15}verification.{1,15}(value|code))"
          - "(?i)(pan|primary.{1,15}account.{1,15}number)"
          - "(?i)cardholder.{1,15}name"
        condition: or

      - type: word
        part: body
        words:
          - "expiry"
          - "expiration"
          - "valid thru"
          - "card type"
          - "card brand"
          - "visa"
          - "mastercard"
          - "amex"
          - "discover"
        case-insensitive: true
        condition: or

      - type: regex
        part: body
        regex:
          - "(?i)(\"|\\'|\\s)(id|user_?id|session_?id|account_?id|customer_?id|order_?id|transaction_?id|request_?id|trace_?id|correlation_?id|meeting_?id|appointment_?id|booking_?id|event_?id|calendar_?id|schedule_?id|tracking_?id|reference_?id|invoice_?id|ticket_?id)(\"|\\')?\\s*[:=]\\s*(\"|\\')?[0-9]{13,19}"
          - "(?i)(\"|\\'|\\s)(timestamp|created_?at|updated_?at|deleted_?at|time|datetime|date|epoch|unix_?time|millis)(\"|\\')?\\s*[:=]\\s*(\"|\\')?[0-9]{13,19}"
          - "(?i)(\"|\\'|\\s)(version|build|revision|release)(\"|\\')?\\s*[:=]\\s*(\"|\\')?[0-9]{13,19}"
          - "\\b[0-9]{13,19}[a-fA-F0-9]{4,}"
          - "\\b[0-9]{13,19}[_-][a-zA-Z0-9]"
          - "\\b[0-9]{13,19}[a-zA-Z]"
          - "(href|src|url|link|path|file|asset|resource)\\s*=\\s*[\"'][^\"']*[0-9]{13,19}"
          - "(https?|ftp|file)://[^\\s]*[0-9]{13,19}"
          - "\\.(js|css|jpg|jpeg|png|gif|svg|woff|woff2|ttf|eot|json|xml|html|htm|ico|webp|mp4|pdf|zip|tar|gz)[\"'\\s?].*[0-9]{13,19}"
          - "\\b[0-9]{13,19}\\.(js|css|jpg|jpeg|png|gif|svg|woff|woff2|ttf|eot|json|xml|html|htm|ico|webp|mp4|pdf)"
          - "\\b[0-9]{1,10}\\.[0-9]{13,19}\\b"
          - "\\b[0-9]{13,19}\\.[0-9]"
          - "\\b1[0-9]{12}\\b"
          - "\\b[2-9][0-9]{12,}\\b"
          - "eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+"
          - "[A-Za-z0-9+/=]{30,}"
          - "[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
          - "\\b[a-fA-F0-9]{32,}\\b"
          - "(?i)(api_?key|access_?token|auth_?token|bearer|secret|key|token)\\s*[:=]\\s*[\"']?[^\\s\"']*[0-9]{13,19}"
          - "(?i)(callback|redirect|return|continue)_?(url|uri|link)?\\s*[:=]\\s*[\"']?[^\\s\"']*[0-9]{13,19}"
          - "(?i)(phone|mobile|tel|fax|ssn|ein|tax_?id)\\s*[:=]\\s*[\"']?[0-9]{13,19}"
          - "[0-9]{10,}[eE][+-]?[0-9]+"
          - "\\b[0-9]{1,4}\\.[0-9]{1,4}\\.[0-9]{1,4}\\.[0-9]{10,}\\b"
          - "(?i)(\"|\\'|\\s)(nonce|salt|hash|checksum|signature|digest|fingerprint)(\"|\\')?\\s*[:=]\\s*(\"|\\')?[0-9]{13,19}"
        condition: or
        negative: true

      - type: word
        part: body
        words:
          - "Access Denied"
          - "403 Forbidden"
          - "401 Unauthorized"
          - "404 Not Found"
          - "500 Internal Server Error"
          - "502 Bad Gateway"
          - "503 Service Unavailable"
        condition: or
        negative: true

    extractors:
      - type: regex
        name: creditcard
        regex:
          - "\\b4[0-9]{12}(?:[0-9]{3})?\\b"
          - "\\b3[47][0-9]{13}\\b"
          - "\\b5[1-5][0-9]{14}\\b|\\b(222[1-9]|22[3-9]\\d|2[3-6]\\d{2}|27[0-1]\\d|2720)[0-9]{12}\\b"
          - "\\b65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})\\b"
          - "\\b(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}\\b"
          - "\\b62[0-9]{14,17}\\b"
          - "\\b3(?:0[0-5]|[68][0-9])[0-9]{11}\\b"
          - "\\b(?:2131|1800|35\\d{3})\\d{11}\\b"
# digest: 4a0a00473045022100f58497cb2b3bcce6a7ba52d96d4f047d25e0fd0f286910557d2a4225c2455cef02201cec73d83f4e56e512686fe600d5a038d595cfff3694858383bc1b298df5b3b3:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.