piper-config.yaml

messageViewers:
  - prefix: [openssl, asn1parse, -inform, DER, -i]
    inputMethod: stdin
    name: OpenSSL ASN.1 decoder
    filter:
      orElse:
        - prefix: !!binary |-
            MII=
        - prefix: !!binary |-
            MIA=
  - prefix: [dumpasn1]
    inputMethod: filename
    name: DumpASN1
    filter:
      orElse:
        - prefix: !!binary |-
            MII=
        - prefix: !!binary |-
            MIA=
  - prefix: [python, -m, json.tool]
    inputMethod: stdin
    name: Python JSON formatter
    filter:
      orElse:
        - { prefix: "{", postfix: "}" }
        - { prefix: "[", postfix: "]" }
  - prefix: [hd]
    inputMethod: stdin
    name: hd
  - prefix: [protoc, --decode_raw]
    inputMethod: stdin
    exitCode: [0]
    name: ProtoBuf
  - prefix: [gron]
    inputMethod: stdin
    name: gron
    filter: { prefix: "{" }
  - prefix: [python, 'SCRIPT_ROOT\extract-web-api-endpoints.py']
    inputMethod: stdin
    requiredInPath: [python]
    exitCode: [0]
    name: extract-web-api-endpoints
    filter:
      header:
        header: Content-Type
        regex:
          pattern: '[a-z]+\/(javascript|x\-javascript)'
          flags: [case insensitive]
    scope: response_only
  - prefix: [python, 'SCRIPT_ROOT\extract-html-metadatas.py']
    inputMethod: stdin
    requiredInPath: [python]
    exitCode: [0]
    name: extract-html-metadatas
    filter:
      header:
        header: Content-Type
        regex:
          pattern: '[a-z]+\/x?(html)'
          flags: [case insensitive]
    scope: response_only
  - prefix: [python, 'SCRIPT_ROOT\extract-jwt-tokens.py']
    inputMethod: stdin
    passHeaders: true
    requiredInPath: [python]
    exitCode: [0]
    name: extract-jwt-tokens
    scope: response_only
  - prefix: [python, 'SCRIPT_ROOT\extract-blazor-webassembly-assemblies.py']
    inputMethod: stdin
    requiredInPath: [python]
    exitCode: [0]
    name: extract-blazor-webassembly-assemblies
    filter:
      header:
        header: Content-Type
        regex:
          pattern: application/json
          flags: [case insensitive]
    scope: response_only
  - prefix: [python, 'SCRIPT_ROOT\extract-uuid-infos.py']
    inputMethod: stdin
    requiredInPath: [python]
    exitCode: [0]
    name: extract-uuid-infos
    filter:
      header:
        header: Content-Type
        regex: { pattern: '[a-z]+\/(javascript|x\-javascript)' }    
    scope: response_only
  - prefix: [python, 'SCRIPT_ROOT\extract-spa-unsafe-patterns.py']
    inputMethod: stdin
    requiredInPath: [python]
    exitCode: [0]
    name: extract-spa-unsafe-patterns
    filter:
      header:
        header: Content-Type
        regex: { pattern: '[a-z]+\/(javascript|x\-javascript)' }
    scope: response_only
  - prefix: [python, 'SCRIPT_ROOT\extract-spa-low-hanging-fruits.py']
    inputMethod: stdin
    requiredInPath: [python]
    exitCode: [0]
    name: extract-spa-low-hanging-fruits
    filter:
      header:
        header: Content-Type
        regex: { pattern: '[a-z]+\/(javascript|x\-javascript|html)' }
    scope: response_only
  - prefix: [python, 'SCRIPT_ROOT\extract-saml-response-infos.py']
    inputMethod: stdin
    requiredInPath: [python]
    exitCode: [0]
    name: extract-saml-response-infos
    filter:
      header:
        header: Content-Type
        regex:
          pattern: '[a-z]+\/x?(html)'
          flags: [case insensitive]
    scope: response_only
  - prefix: [python, 'SCRIPT_ROOT\extract-saml-request-infos.py']
    inputMethod: stdin
    passHeaders: true
    requiredInPath: [python]
    exitCode: [0]
    name: extract-saml-request-infos
    scope: request_only
menuItems:
  - prefix: [okular]
    inputMethod: filename
    name: Okular
    filter:
      regex:
        pattern: ^%PDF-1\.[0-9]
        flags: [case insensitive, dotall]
    hasGUI: true
  - prefix: [feh, -FZ]
    inputMethod: filename
    name: feh
    filter:
      cmd:
        prefix: [file, -i, "-"]
        inputMethod: stdin
        stdout:
          regex: { pattern: image/ }
    hasGUI: true
    maxInputs: 1
  - prefix: [urxvt, -e, hexcurse]
    inputMethod: filename
    name: hexcurse
    hasGUI: true
    maxInputs: 1
  - prefix: [urxvt, -e, vbindiff]
    inputMethod: filename
    name: vbindiff without headers
    hasGUI: true
    maxInputs: 2
  - prefix: [urxvt, -e, vbindiff]
    inputMethod: filename
    passHeaders: true
    name: vbindiff with headers
    hasGUI: true
    maxInputs: 2
  - prefix: [git, diff, --color=always]
    inputMethod: filename
    name: git diff
    minInputs: 2
    maxInputs: 2
  - prefix: [git, diff, --color=always, -w]
    inputMethod: filename
    name: git diff (ignore whitespace)
    minInputs: 2
    maxInputs: 2
  - prefix: [radiff2, -x]
    inputMethod: filename
    name: radiff2 (two column hexdump diffing)
    minInputs: 2
    maxInputs: 2
  - prefix: [sh, -c, dos2unix | xclip -selection clipboard]
    inputMethod: stdin
    passHeaders: true
    requiredInPath: [dos2unix, xclip]
    name: Copy to clipboard with headers without \r
    hasGUI: true
  - prefix: [meld]
    inputMethod: filename
    passHeaders: true
    name: Meld
    hasGUI: true
    avoidPipe: true
    minInputs: 2
    maxInputs: 3
  - prefix: [sh, -c, fromdos | xsel -i -b]
    inputMethod: stdin
    passHeaders: true
    requiredInPath: [fromdos, xsel]
    name: Copy to clipboard with headers without \r (alt)
    hasGUI: true
intruderPayloadProcessors:
  - prefix: [
        sh,
        -c,
        dd if=/dev/urandom of=/dev/stdout bs=1 count=`shuf -i1-100 -n1`
        status=none,
      ]
    inputMethod: stdin
    requiredInPath: [dd, shuf]
    name: replace with /dev/urandom
commentators:
  - prefix: [sha256sum]
    inputMethod: stdin
    name: SHA-256
  - prefix: [python, 'SCRIPT_ROOT\detect-non-standart-headers.py']
    inputMethod: stdin
    passHeaders: true
    requiredInPath: [python]
    exitCode: [0]
    name: detect-non-standart-headers
    scope: response_only
    overwrite: true
    applyWithListener: true
highlighters:
  - prefix: [python, 'SCRIPT_ROOT\detect-request-to-web-api.py']
    inputMethod: stdin
    passHeaders: true
    requiredInPath: [python]
    exitCode: [1]
    name: detect-request-to-web-api
    scope: request_only
    applyWithListener: true
    color: orange
  - prefix: [python, 'SCRIPT_ROOT\detect-response-with-errors-disclosure.py']
    inputMethod: stdin
    requiredInPath: [python]
    exitCode: [1]
    name: detect-response-with-errors-disclosure
    scope: response_only
    overwrite: true
    applyWithListener: true
    color: cyan