Skip to main content

Configuration

Even though the tool does not requiere any particular configuration to work, we can enhance its functionality to optimize the performance and improve its findings by eliminating many false positives.

We have some optional configuration files which must have a specific name and can be located either in the local directory, or in a directory named ~/reveal/ under the user's home directory

These configuration files affect the following functionalities:

Places to ignore​

If a file named reveal_ignore.txt is present, it can contain directories or file names patterns, which should be ignored by the tool.

Each line in this file contains a regular expression, so be aware that if we want to specify a single dot, we must preceed it with an escape character (instead of just placing a single . we need to put \.)

For example, in Linux, we can usually ignore the following files and directories:

\.git
\.tmp
\.cache
\.config
(?i)\.gif
(?i)\.jpg
(?i)\.png
(?i)\.svg
\.local
\.npm
node_modules
backup.*\.txt$
# This is a comment

Similarly, in Windows, we could ignore these:

\.git
node_modules
backup.*\.txt$
# This is a comment
AppData
Temp
OneDrive
Public
Windows
Program.Files
(?i)\.tmp
(?i)\.jpg$
(?i)\.png$
(?i)\.gif$
(?i)\.exe$
(?i)\.com$

BIN list​

If we have a file named reveal_binlist.txt it should contain the list of BINs to consider. This list can contain parcial BINs, so if we put something like 5399 we will consider all numbers that start with the value 5399, but if we put the value 540034 then all numbers starting with it will match.

White list​

We can have cases where some values like some IDs can be validated as a card number but we are sure they are just a coincidence and we want to discard them. For these cases we can ignore those lines. This can be specified for each file name pattern so we can be very specific on what to discard.

This is defined in a file named reveal_whitelist.txt

This file has the typical format for .INI files like this:

[pattern]
s_fixed_string_to_ignore
r_regex_pattern_to_ignore

Donde:

  • [pattern]: Is a file pattern using the glob-style representation.
  • s_: Represents a fixed string.
  • r_: Represents a regular expression.

Example:​

If we know that in our log files with names like *output_log.txt we will have lines that contain ID values that we need to ignore, we could have something like this in the file:

[*output_log.txt]
s_Client_ID
r_-ID\s+\d+$

Then, when processing files with a name like *output_log.txt, we will ignore all lines containing the string "Client_ID" and those lines that contain the string "-ID" followed by spaces and a chain of digits up to the end of the line.