数字支付与移动支付安全取证深度分析

idevicebackup2 backup --full --no-keychain /tmp/ios_backup/
ideviceinfo -k SerialNumber
idevicepair pair
ideviceprovision list

ssh root@<device_ip> -p 2222
find /var/mobile/Containers/Data/Application/ -name "*.sqlite" -o -name "*.db"
ls -la /var/mobile/Containers/Data/Application/<app_uuid>/Documents/
sqlite3 /var/mobile/Containers/Data/Application/<app_uuid>/Documents/transactions.db ".tables"

sqlite3 Keychain-2.db "SELECT service, account, hex(v_Data) FROM csi_metadata WHERE service LIKE '%pay%' OR service LIKE '%wallet%';"

adb root
adb shell cp -r /data/data/com.tencent.mm/databases/ /sdcard/wechat_db/
adb shell cp -r /data/data/com.eg.android.AlipayGphone/databases/ /sdcard/alipay_db/
adb pull /sdcard/wechat_db/ ./evidence/wechat/
adb pull /sdcard/alipay_db/ ./evidence/alipay/

adb shell su -c "cat /data/data/com.<package>/databases/*.db-wal" > wal_dump.bin
adb shell su -c "strings /proc/<pid>/maps | grep key"
adb shell su -c "dd if=/data/data/com.<package>/databases/encrypted.db bs=4096 count=3 2>/dev/null"

sqlite3 transactions.db ".schema transactions"
sqlite3 transactions.db "SELECT datetime(timestamp/1000, 'unixepoch', 'localtime'), amount, currency, type, counterparty FROM transactions ORDER BY timestamp DESC LIMIT 50;"
sqlite3 transactions.db "SELECT count(*) as total, sum(amount) as total_amount FROM transactions WHERE type='OUTGOING' AND timestamp > strftime('%s', '2026-01-01') * 1000;"
sqlite3 transactions.db "SELECT counterparty, count(*) as tx_count, sum(amount) as total_amount FROM transactions GROUP BY counterparty ORDER BY total_amount DESC LIMIT 20;"

sqlite3 transactions.db "PRAGMA freelist_count;"
sqlite3 transactions.db "PRAGMA page_count;"
python3 -c "
import sqlite3
conn = sqlite3.connect('transactions.db')
cursor = conn.cursor()
cursor.execute('SELECT name FROM sqlite_master WHERE type=\"table\"')
tables = cursor.fetchall()
for t in tables:
    cursor.execute(f'PRAGMA table_info({t[0]})')
    cols = [c[1] for c in cursor.fetchall()]
    print(f'{t[0]}: {cols}')
"
strings -n 10 transactions.db-wal | grep -E "^[0-9a-f]{32,}|transaction|payment|amount"

import sqlite3
import os
import json
from datetime import datetime

def parse_payment_database(db_path, app_type="generic"):
    transactions = []
    if not os.path.exists(db_path):
        return transactions
    conn = sqlite3.connect(db_path)
    conn.row_factory = sqlite3.Row
    cursor = conn.cursor()
    try:
        cursor.execute("SELECT name FROM sqlite_master WHERE type='table'")
        tables = [r[0] for r in cursor.fetchall()]
        tx_table = None
        for t in tables:
            cursor.execute(f"PRAGMA table_info({t})")
            cols = [c[1] for c in cursor.fetchall()]
            if any(k in cols for k in ['amount', 'money', 'value']):
                if any(k in cols for k in ['time', 'date', 'created_at', 'timestamp']):
                    tx_table = t
                    break
        if not tx_table:
            return transactions
        cursor.execute(f"SELECT * FROM {tx_table}")
        for row in cursor.fetchall():
            tx = dict(row)
            tx['_source_db'] = db_path
            tx['_app_type'] = app_type
            tx['_extracted_at'] = datetime.now().isoformat()
            transactions.append(tx)
    except sqlite3.DatabaseError:
        cursor.execute("PRAGMA integrity_check")
        result = cursor.fetchone()
        if result[0] != 'ok':
            print(f"Database integrity issue: {db_path}")
    finally:
        conn.close()
    return transactions

def merge_transaction_timeline(all_transactions):
    sorted_tx = sorted(all_transactions, key=lambda x: x.get('timestamp', x.get('time', 0)))
    return sorted_tx

databases = [
    ("/evidence/wechat/EnMicroMsg.db", "wechat"),
    ("/evidence/alipay/alipay.db", "alipay"),
    ("/evidence/bank/pay.db", "bank_app"),
]
all_tx = []
for db_path, app_type in databases:
    all_tx.extend(parse_payment_database(db_path, app_type))

timeline = merge_transaction_timeline(all_tx)
with open('merged_timeline.json', 'w', encoding='utf-8') as f:
    json.dump(timeline, f, indent=2, ensure_ascii=False, default=str)
print(f"Total transactions extracted: {len(timeline)}")

pm3
lf search
hf search
hf emv reader -v
hf emv dump -f emv_trace.bin
hf list raw
hf 14a sniff -1

python3 -c "
import struct
import json

def parse_nfc_trace(trace_file):
    events = []
    with open(trace_file, 'rb') as f:
        data = f.read()
    offset = 0
    while offset < len(data) - 4:
        timestamp = struct.unpack_from('<I', data, offset)[0]
        event_type = data[offset + 4]
        payload_len = struct.unpack_from('<H', data, offset + 5)[0]
        payload = data[offset + 7:offset + 7 + payload_len]
        events.append({
            'timestamp': timestamp,
            'type': hex(event_type),
            'length': payload_len,
            'payload_hex': payload.hex()
        })
        offset += 7 + payload_len
    return events

def detect_relay_anomaly(events):
    anomalies = []
    for i in range(1, len(events)):
        delta = events[i]['timestamp'] - events[i-1]['timestamp']
        if delta > 5000000:
            anomalies.append({
                'position': i,
                'gap_ms': delta / 1000,
                'before': events[i-1]['payload_hex'][:20],
                'after': events[i]['payload_hex'][:20]
            })
    return anomalies

events = parse_nfc_trace('nfc_capture.bin')
anomalies = detect_relay_anomaly(events)
print(f'Total NFC events: {len(events)}')
print(f'Potential relay anomalies: {len(anomalies)}')
for a in anomalies:
    print(f\"  Gap: {a['gap_ms']:.1f}ms between events at position {a['position']}\")
"

import requests
import hashlib
import json
import time

QR_CODE_MONITOR_ENDPOINT = "https://api.payment-provider.com/qr/verify"

def compute_qr_hash(qr_content):
    return hashlib.sha256(qr_content.encode('utf-8')).hexdigest()

def verify_qr_code_merchant(qr_content, expected_merchant_id):
    response = requests.post(QR_CODE_MONITOR_ENDPOINT, json={
        "qr_content": qr_content,
        "merchant_id": expected_merchant_id
    })
    result = response.json()
    return result.get('verified', False), result.get('actual_merchant', None)

def detect_qr_tampering(qr_content_list, baseline_db):
    tampering_report = []
    for qr in qr_content_list:
        qr_hash = compute_qr_hash(qr)
        if qr_hash not in baseline_db:
            decoded = decode_qr_content(qr)
            tampering_report.append({
                'qr_hash': qr_hash,
                'status': 'UNKNOWN_QR',
                'decoded_url': decoded,
                'timestamp': time.time(),
                'severity': 'HIGH'
            })
        else:
            record = baseline_db[qr_hash]
            if record.get('expected_amount') and record['expected_amount'] != decoded.get('amount'):
                tampering_report.append({
                    'qr_hash': qr_hash,
                    'status': 'AMOUNT_MISMATCH',
                    'expected': record['expected_amount'],
                    'actual': decoded.get('amount'),
                    'severity': 'CRITICAL'
                })
    return tampering_report

def decode_qr_content(qr_string):
    import urllib.parse
    if qr_string.startswith('http'):
        parsed = urllib.parse.urlparse(qr_string)
        params = urllib.parse.parse_qs(parsed.query)
        return {'type': 'url', 'host': parsed.hostname, 'params': params}
    return {'type': 'raw', 'content': qr_string[:100]}

import hashlib
import json
from datetime import datetime

class TransactionLogIntegrityVerifier:
    def __init__(self):
        self.chain = []
        self.broken_links = []
        self.verified_count = 0

    def compute_log_hash(self, log_entry, prev_hash="GENESIS"):
        canonical = json.dumps({
            'timestamp': log_entry.get('timestamp'),
            'transaction_id': log_entry.get('transaction_id'),
            'amount': log_entry.get('amount'),
            'merchant_id': log_entry.get('merchant_id'),
            'status': log_entry.get('status'),
            'prev_hash': prev_hash
        }, sort_keys=True)
        return hashlib.sha256(canonical.encode()).hexdigest()

    def verify_chain(self, log_entries):
        prev_hash = "GENESIS"
        for i, entry in enumerate(log_entries):
            expected_hash = self.compute_log_hash(entry, prev_hash)
            actual_hash = entry.get('integrity_hash', '')
            if expected_hash == actual_hash:
                self.verified_count += 1
                prev_hash = actual_hash
            else:
                self.broken_links.append({
                    'position': i,
                    'transaction_id': entry.get('transaction_id'),
                    'expected_hash': expected_hash,
                    'actual_hash': actual_hash,
                    'timestamp': entry.get('timestamp')
                })
                prev_hash = actual_hash
        return len(self.broken_links) == 0

    def generate_report(self):
        return {
            'total_entries': self.verified_count + len(self.broken_links),
            'verified_entries': self.verified_count,
            'broken_links': len(self.broken_links),
            'integrity_status': 'PASS' if not self.broken_links else 'FAIL',
            'broken_details': self.broken_links
        }

verifier = TransactionLogIntegrityVerifier()
with open('payment_logs.json', 'r') as f:
    logs = json.load(f)
result = verifier.verify_chain(logs)
report = verifier.generate_report()
print(json.dumps(report, indent=2))

python3 -c "
import json
from datetime import datetime, timedelta

def detect_timestamp_anomalies(logs):
    anomalies = []
    prev_ts = None
    for i, log in enumerate(logs):
        ts = log.get('timestamp', 0)
        if prev_ts and ts < prev_ts:
            anomalies.append({
                'type': 'REVERSE_ORDER',
                'position': i,
                'current_ts': ts,
                'prev_ts': prev_ts,
                'tx_id': log.get('transaction_id')
            })
        if prev_ts and ts - prev_ts > 3600000:
            anomalies.append({
                'type': 'LARGE_GAP',
                'position': i,
                'gap_ms': ts - prev_ts,
                'tx_id': log.get('transaction_id')
            })
        prev_ts = ts
    return anomalies

with open('payment_logs.json') as f:
    logs = json.load(f)
result = detect_timestamp_anomalies(logs)
print(f'Timestamp anomalies found: {len(result)}')
for a in result:
    print(f\"  {a['type']}: {a['tx_id']}\")
"

find . -name "*.java" -o -name "*.kt" -o -name "*.swift" -o -name "*.m" | \
  xargs grep -n -E "(api[_-]?key|secret[_-]?key|merchant[_-]?id|pay[_-]?key|token)" | \
  grep -v -E "^Binary|test/|Test\.|mock|Mock" | \
  head -50

grep -rn -E "(sk_live_|pk_live_|sk_test_|pk_test_)" --include="*.java" --include="*.swift" --include="*.json" --include="*.plist" .

grep -rn -E "APP_ID.*=.*[\"'][0-9]{16,}[\"']" --include="*.java" --include="*.xml" --include="*.properties" .

grep -rn -E "(wxpay|alipay|wechat|tenpay).*[\"'][a-zA-Z0-9]{32,}[\"']" --include="*.java" --include="*.swift" --include="*.xml" .

import requests
import json

BLOCKCHAIN_API = "https://blockchain.info"

def trace_mixed_payment_chain(legacy_account_id, crypto_address):
    chain = {
        'legacy_payments': [],
        'conversion_events': [],
        'crypto_transfers': [],
        'mixing_events': [],
        'final_destinations': []
    }
    legacy_transactions = query_legacy_payment_system(legacy_account_id)
    chain['legacy_payments'] = legacy_transactions
    for tx in legacy_transactions:
        if tx.get('converted_to_crypto'):
            deposit_addr = tx.get('crypto_deposit_address')
            if deposit_addr:
                chain['conversion_events'].append({
                    'timestamp': tx['timestamp'],
                    'fiat_amount': tx['amount'],
                    'crypto_address': deposit_addr
                })
    if crypto_address:
        url = f"{BLOCKCHAIN_API}/rawaddr/{crypto_address}?limit=50"
        response = requests.get(url)
        addr_data = response.json()
        for tx in addr_data.get('txs', []):
            for output in tx.get('out', []):
                out_addr = output.get('addr', '')
                if out_addr != crypto_address:
                    chain['crypto_transfers'].append({
                        'tx_hash': tx['hash'],
                        'amount_btc': output.get('value', 0) / 1e8,
                        'destination': out_addr,
                        'block_height': tx.get('block_height', 0)
                    })
    mixing_indicators = detect_mixing_patterns(chain['crypto_transfers'])
    chain['mixing_events'] = mixing_indicators
    return chain

def detect_mixing_patterns(transfers):
    patterns = []
    amount_groups = {}
    for t in transfers:
        rounded = round(t['amount_btc'], 4)
        if rounded not in amount_groups:
            amount_groups[rounded] = []
        amount_groups[rounded].append(t)
    for amount, txs in amount_groups.items():
        if len(txs) >= 3:
            patterns.append({
                'type': 'EQUAL_AMOUNT_SPLIT',
                'amount_btc': amount,
                'occurrences': len(txs),
                'confidence': 'HIGH',
                'indication': 'Potential CoinJoin or mixing service'
            })
    return patterns

def query_legacy_payment_system(account_id):
    return [{'timestamp': 1700000000, 'amount': 5000, 'converted_to_crypto': True, 'crypto_deposit_address': 'bc1q...'}]

title: Suspicious NFC Relay Attack Detection
id: d3f4e5a6-b7c8-9d0e-1f2a-3b4c5d6e7f80
status: stable
description: 检测NFC通信中可能的中继攻击特征，包括异常的交易延迟和频率
references:
  - https://www.emvco.com/emv-technologies/contactless/
author: BlueTeam Analyst
date: 2026/07/23
tags:
  - attack.lateral_movement
  - attack.t1557
logsource:
  category: payment_nfc
  product: mobile_payment
detection:
  selection_relay_delay:
    nfc_transaction_delay_ms:
      gt: 2000
  selection_relay_frequency:
    nfc_transaction_count:
      gt: 10
    nfc_transaction_window_sec:
      lt: 30
  selection_uid_change:
    nfc_card_uid:
      changed: true
  condition: selection_relay_delay or selection_relay_frequency or selection_uid_change
level: high
falsepositives:
  - 正常的NFC慢速响应
  - 多卡切换操作
fields:
  - device_id
  - nfc_transaction_delay_ms
  - nfc_card_uid
  - timestamp

title: QR Code Payment Tampering Detection
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: stable
description: 检测二维码支付中可能的参数篡改行为
references:
  - https://owasp.org/www-project-mobile-top-10/
author: BlueTeam Analyst
date: 2026/07/23
tags:
  - attack.credential_access
  - attack.t1557
logsource:
  category: payment_qr
  product: mobile_payment
detection:
  selection_amount_tamper:
    payment_amount:
      neq: original_amount
    merchant_id:
      neq: original_merchant
  selection_url_redirect:
    callback_url:
      contains:
        - 'evil.com'
        - 'phishing'
        - 'redirect'
  selection_sign_mismatch:
    request_signature_valid: false
  condition: selection_amount_tamper or selection_url_redirect or selection_sign_mismatch
level: critical
falsepositives:
  - 正常的金额修改（如优惠折扣）
fields:
  - transaction_id
  - payment_amount
  - original_amount
  - merchant_id
  - callback_url
  - request_signature_valid
  - timestamp

title: Payment API Key Exposure Detection
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: stable
description: 检测支付API密钥的潜在泄露行为
references:
  - https://owasp.org/API-Security/
author: BlueTeam Analyst
date: 2026/07/23
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: code_scan
  product: payment_sdk
detection:
  selection_hardcoded_key:
    pattern:
      - '*api_key*="sk_live_*"'
      - '*api_key*="pk_live_*"'
      - '*secret*="[a-zA-Z0-9]{32,}"'
      - '*merchant_key*="*"'
  selection_key_in_log:
    log_level: 'INFO'
    message:
      contains:
        - 'api_key'
        - 'secret_key'
        - 'merchant_id'
        - 'access_token'
  condition: selection_hardcoded_key or selection_key_in_log
level: critical
falsepositives:
  - 测试环境中的硬编码测试密钥
fields:
  - file_path
  - line_number
  - key_type
  - key_value_masked
  - context

#!/bin/bash
echo "[*] Payment Security Automated Scan"
echo "====================================="

echo "[+] Scanning for hardcoded payment keys..."
find /data/app/ -name "*.java" -o -name "*.kt" -o -name "*.swift" -o -name "*.m" 2>/dev/null | \
  xargs grep -n -E "(sk_live_|pk_live_|sk_test_|pk_test_|APP_ID.*[\"'][0-9]{16,})" 2>/dev/null | \
  tee /tmp/payment_key_findings.txt

echo "[+] Scanning for payment data in clipboard..."
adb shell "cat /dev/clipboard" 2>/dev/null | \
  grep -E "^[0-9]{16,19}$|^[0-9]{3,4}$|^(visa|mastercard|amex)" 2>/dev/null | \
  tee /tmp/clipboard_card_data.txt

echo "[+] Checking for suspicious NFC-related processes..."
adb shell "ps -A" 2>/dev/null | \
  grep -iE "nfc|proxmark|nfcpy|ndef|cardemu|hostap" 2>/dev/null | \
  tee /tmp/nfc_process_findings.txt

echo "[+] Analyzing payment app database integrity..."
for db in $(find /data/data/ -name "*.db" 2>/dev/null | grep -iE "pay|wallet|transaction"); do
    result=$(sqlite3 "$db" "PRAGMA integrity_check;" 2>/dev/null)
    if [ "$result" != "ok" ]; then
        echo "  [!] Integrity issue: $db - $result"
    fi
done 2>/dev/null | tee /tmp/db_integrity_report.txt

echo "[+] Checking payment SDK versions..."
grep -rn "versionName\|versionCode\|MARKETING_VERSION\|CURRENT_PROJECT_VERSION" \
  /data/app/*/base.apk 2>/dev/null | \
  grep -iE "pay|stripe|paypal|wechat|alipay" | \
  tee /tmp/sdk_version_report.txt

echo "[+] Detecting payment log tampering..."
find /var/log/ /data/log/ -name "*payment*" -o -name "*transaction*" -o -name "*settlement*" 2>/dev/null | \
  while read logfile; do
    first_ts=$(head -1 "$logfile" 2>/dev/null | grep -oE "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}")
    last_ts=$(tail -1 "$logfile" 2>/dev/null | grep -oE "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}")
    if [ -n "$first_ts" ] && [ -n "$last_ts" ]; then
        echo "  Log: $logfile | First: $first_ts | Last: $last_ts"
    fi
  done 2>/dev/null | tee /tmp/log_tampering_check.txt

echo "[+] Scanning for QR code overlay attack artifacts..."
find /data/ /tmp/ /sdcard/ -name "*.png" -o -name "*.jpg" -o -name "*.svg" 2>/dev/null | \
  xargs file 2>/dev/null | grep -E "image|SVG" | \
  head -20 | tee /tmp/qr_image_findings.txt

echo "[+] Generating payment security scan report..."
{
    echo "=== Payment Security Scan Report ==="
    echo "Scan Time: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
    echo "--- Key Findings ---"
    echo "Hardcoded keys found: $(wc -l < /tmp/payment_key_findings.txt 2>/dev/null || echo 0)"
    echo "NFC suspicious processes: $(wc -l < /tmp/nfc_process_findings.txt 2>/dev/null || echo 0)"
    echo "Database integrity issues: $(wc -l < /tmp/db_integrity_report.txt 2>/dev/null || echo 0)"
} > /tmp/payment_security_report.txt

cat /tmp/payment_security_report.txt
echo "[*] Scan complete. Reports saved to /tmp/"

import os
import json
import hashlib
import sqlite3
from datetime import datetime, timedelta

class PaymentSecurityDetector:
    def __init__(self, evidence_dir):
        self.evidence_dir = evidence_dir
        self.findings = []
        self.risk_scores = {
            'CRITICAL': 10,
            'HIGH': 7,
            'MEDIUM': 4,
            'LOW': 1
        }

    def scan_hardcoded_keys(self):
        key_patterns = [
            'sk_live_', 'pk_live_', 'sk_test_', 'pk_test_',
            'APP_ID', 'merchant_key', 'webhook_secret'
        ]
        for root, dirs, files in os.walk(self.evidence_dir):
            for f in files:
                if f.endswith(('.java', '.kt', '.swift', '.m', '.json', '.xml', '.plist')):
                    fpath = os.path.join(root, f)
                    try:
                        with open(fpath, 'r', errors='ignore') as fh:
                            for i, line in enumerate(fh, 1):
                                for pattern in key_patterns:
                                    if pattern.lower() in line.lower():
                                        self.findings.append({
                                            'type': 'HARDCODED_KEY',
                                            'severity': 'CRITICAL',
                                            'file': fpath,
                                            'line': i,
                                            'pattern': pattern,
                                            'context': line.strip()[:100]
                                        })
                    except Exception:
                        pass
        return self.findings

    def verify_database_integrity(self):
        for root, dirs, files in os.walk(self.evidence_dir):
            for f in files:
                if f.endswith('.db'):
                    dbpath = os.path.join(root, f)
                    if any(kw in f.lower() for kw in ['pay', 'wallet', 'trans', 'card']):
                        try:
                            conn = sqlite3.connect(dbpath)
                            cursor = conn.cursor()
                            cursor.execute("PRAGMA integrity_check")
                            result = cursor.fetchone()
                            if result[0] != 'ok':
                                self.findings.append({
                                    'type': 'DB_INTEGRITY_FAILURE',
                                    'severity': 'HIGH',
                                    'file': dbpath,
                                    'detail': result[0]
                                })
                            cursor.execute("PRAGMA freelist_count")
                            freelist = cursor.fetchone()[0]
                            cursor.execute("PRAGMA page_count")
                            pages = cursor.fetchone()[0]
                            if pages > 0 and freelist / pages > 0.3:
                                self.findings.append({
                                    'type': 'HIGH_FREELIST_RATIO',
                                    'severity': 'MEDIUM',
                                    'file': dbpath,
                                    'detail': f'freelist={freelist}/pages={pages} ratio={freelist/pages:.2f}'
                                })
                            conn.close()
                        except Exception:
                            pass
        return self.findings

    def detect_log_tampering(self):
        log_patterns = ['payment', 'transaction', 'settlement', 'transfer']
        for root, dirs, files in os.walk(self.evidence_dir):
            for f in files:
                if any(kw in f.lower() for kw in log_patterns):
                    fpath = os.path.join(root, f)
                    try:
                        with open(fpath, 'r', errors='ignore') as fh:
                            lines = fh.readlines()
                        timestamps = []
                        for line in lines[:500]:
                            import re
                            ts_match = re.search(r'(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})', line)
                            if ts_match:
                                timestamps.append(ts_match.group(1))
                        for i in range(1, len(timestamps)):
                            if timestamps[i] < timestamps[i-1]:
                                self.findings.append({
                                    'type': 'TIMESTAMP_REVERSAL',
                                    'severity': 'HIGH',
                                    'file': fpath,
                                    'detail': f'Reversal at line approx {i}: {timestamps[i]} < {timestamps[i-1]}'
                                })
                    except Exception:
                        pass
        return self.findings

    def generate_report(self):
        report = {
            'scan_time': datetime.now().isoformat(),
            'evidence_dir': self.evidence_dir,
            'total_findings': len(self.findings),
            'findings_by_severity': {},
            'findings': self.findings
        }
        for f in self.findings:
            sev = f.get('severity', 'UNKNOWN')
            report['findings_by_severity'][sev] = report['findings_by_severity'].get(sev, 0) + 1
        total_risk = sum(self.risk_scores.get(f.get('severity', ''), 0) for f in self.findings)
        report['total_risk_score'] = total_risk
        report['risk_level'] = 'CRITICAL' if total_risk > 50 else 'HIGH' if total_risk > 25 else 'MEDIUM' if total_risk > 10 else 'LOW'
        return report

detector = PaymentSecurityDetector('/tmp/evidence')
detector.scan_hardcoded_keys()
detector.verify_database_integrity()
detector.detect_log_tampering()
report = detector.generate_report()
print(json.dumps(report, indent=2, ensure_ascii=False))

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole \
  --start-time 2019-06-01T00:00:00Z \
  --end-time 2019-07-30T00:00:00Z \
  --output json | jq '.Events[] | {time:.EventTime, user:.Username, source:.EventSource, detail:.CloudTrailEvent}'

aws s3api get-bucket-logging --bucket target-payment-bucket

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::ACCOUNT:role/WAFRole \
  --action-names s3:GetObject s3:ListBucket \
  --resource-arns arn:aws:s3:::payment-data-*

grep -rn "password\|Password\|PASSWORD\|api_key\|apikey\|API_KEY" \
  /opt/uber/internal-scripts/*.ps1 \
  /opt/uber/deploy-scripts/*.py

find / -name "*.ps1" -exec grep -l "Pantry\|AdminPortal\|vCenter" {} \; 2>/dev/null

python3 -c "
import json
with open('slack_export.json') as f:
    messages = json.load(f)
for msg in messages:
    if 'hack' in msg.get('text','').lower() or 'screenshot' in msg.get('text','').lower():
        print(f\"{msg.get('user')} @ {msg.get('ts')}: {msg.get('text')[:100]}\")
"