{"id":267,"date":"2022-03-22T12:05:03","date_gmt":"2022-03-22T12:05:03","guid":{"rendered":"https:\/\/bevigil.com\/blog\/?p=267"},"modified":"2022-06-22T13:31:25","modified_gmt":"2022-06-22T13:31:25","slug":"bevigil-3-0-release-notes","status":"publish","type":"post","link":"https:\/\/bevigil.com\/blog\/bevigil-3-0-release-notes\/","title":{"rendered":"BeVigil 3.0 Release Notes: BeVigil OSINT API Launch, redesigned blog and logo, credit changes, and much more!<\/strong>"},"content":{"rendered":"\n
\n\n\n\n

What\u2019s New<\/strong> \ud83d\ude80\u2728<\/h1>\n\n\n\n

BeVigil OSINT API Launch<\/strong><\/h3>\n\n\n\n

We are happy to announce the launch of the NEW BeVigil OSINT Service!<\/strong><\/p>\n\n\n\n

The BeVigil OSINT Service is an innovation to aid asset discovery from mobile apps and create a new channel for asset recon<\/strong>. We have created and maintained a searchable repository of more than half a million – 500,000<\/strong> Android apps that have been extracted and unpacked, with the number of apps on the platform continuously growing as users upload more apps in real time . Users can search for exposed\/ hardcoded assets such as API Keys and secrets in the source codes of the apps and identify vulnerabilities such as cloud misconfigurations, leaking assets, exposed backend services, and many more. <\/p>\n\n\n\n

Main services offered by the API<\/strong><\/h4>\n\n\n\n
  1. Returns wordlist: For a given app package ID (example: com.whatsapp), get a wordlist combining paths, filenames, rest_api, URL parameters, and endpoints<\/li>
  2. Finds Hosts: For a given app package ID, get all unique hostnames including domains and subdomains hardcoded inside the application<\/li>
  3. Find S3 buckets: For a given package ID, get all s3 buckets from the source code of an APK. As well as for a given keyword, get all S3 URLs for the associated input keyword<\/li>
  4. Find all assets: For a given package ID, get all associated assets including rest_api, paths, hostnames, subdomains, S3 buckets, IP addresses, filenames, AWS URLs, Azure containers, etc<\/li>
  5. Find Apps: For a given hostname, get all apps that contain any reference to it<\/li>
  6. Find subdomains: Find subdomains for a given domain<\/li>
  7. Returns URLs: For a given domain name, get all associated URLs<\/li><\/ol>\n\n\n\n

    This powerful tool provides access to millions of asset footprint data points including domain intel, cloud services, API information, and third-party assets extracted from millions of mobile apps being continuously uploaded and scanned by users on bevigil.com. This is the world\u2019s first portal to access millions of untouched assets<\/strong> from mobile apps. <\/p>\n\n\n\n

    Enhancements to mobile app<\/strong> scanning<\/strong><\/h3>\n\n\n\n

    We have made major improvements to our app scanning capabilities by adding 56 new secret key detection rules<\/strong> (including eg. Juspay, Alibaba, Dropbox, and Azure<\/strong>) and 11 new cloud asset detection <\/strong>rules (including Zendesk, Pastebin, Heroku). We have added the top 12 CRM regexes including Salesforce Sales Cloud, Hubspot Sales, Zendesk, Streak, Freshsales, and Zoho<\/strong>.<\/p>\n\n\n\n

    Using this feature, we recently discovered exposed HubSpot API keys in several apps leading to comprise of 1.6 million users’ data. The blog post about this discovery can be found here.<\/a> <\/p>\n\n\n\n

    These additions will help users gain access to more knowledge about the hardcoded sensitive information in mobile applications. <\/p>\n\n\n\n

    Blog Redesign and new articles!<\/strong><\/h3>\n\n\n\n

    The Blog section in BeVigil has a facelift, with a simple, more intuitive, and brand-new UI! <\/p>\n\n\n\n

    \"\"\/<\/figure>\n\n\n\n

    <\/p>\n\n\n\n

    Check out the latest blogs:  <\/p>\n\n\n\n