# One regex per line.
# Lines starting with # are ignored.
# ============================
# MCP-Fuzzzer - Response Patterns to find vulnerabilities
# ============================
#Information Disclosure-System Errors
(?i)(stack trace|exception|fatal error|uncaught error|line \d+)
(?i)(SQL syntax.*MySQL|Warning.*mysql_.*|valid MySQL result)
(?i)(PostgreSQL.*ERROR|Warning.*pg_.*|valid PostgreSQL result)
(?i)(ORA-\d{5}|Oracle error|Oracle.*Driver)
(?i)(Driver.*SQL Server|OLE DB Provider for SQL Server|Unclosed quotation mark)
#Server-Technology Banners
(?i)(X-Powered-By:|Server:.*(Apache|nginx|IIS|Tomcat|Node.js))
#Sensitive Data - PII Exposure
#API Keys & Tokens
(?i)(api[_-]?key|auth[_-]?token|secret|password)["'\s]*[:=]["'\s]*([a-zA-Z0-9_\-]{16,})
#AWS Access Key
(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA)[A-Z0-9]{16}
#Bearer Tokens
(?i)Bearer\s[a-zA-Z0-9_\-\.]{20,}
#Credentials & Secrets
#Private Keys
(RSA/SSH): -----BEGIN [A-Z ]+ PRIVATE KEY-----
#Personally Identifiable Information (PII)
#Email Addresses
[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}
#IPv4 Addresses
\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b
#US Social Security Number (SSN)
\b\d{3}-\d{2}-\d{4}\b
#Vulnerability Verification - Exploit Testing
#Local File Inclusion (LFI)
#Linux (/etc/passwd)
root:x:0:0:
#Windows (win.ini)
(?i)\[for\s+them\s+to\s+load\]|\[mail\]

