{"id":15075,"date":"2023-04-13T07:47:42","date_gmt":"2023-04-13T07:47:42","guid":{"rendered":"https:\/\/www.dfi.ch\/?p=15075"},"modified":"2023-04-13T15:03:12","modified_gmt":"2023-04-13T15:03:12","slug":"blocking-leaked-passwords","status":"publish","type":"post","link":"https:\/\/www.cheops-technology.ch\/en\/blocking-leaked-passwords\/","title":{"rendered":"Blocking leaked passwords with IntelligenceX and ModSecurity"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Introduction<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Background and objectives<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Data leaks are becoming more and more numerous and the data contained more and more critical (PHI, PII, Password, \u2026.). Although necessary, the use of a password manager alone is no longer sufficient. Breaches can come from many sources, and even from the password manager itself.<\/p>

It is therefore essential to monitor the various data leaks concerning you, and to take automatic remediation or mitigation measures \u2013 trust does not exclude control. For this, two tools are available: ModSecurity and IntelligenceX.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

IT tools presentation<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ModSecurity<\/b> is an application firewall (WAF), whose role is to filter incoming requests to an HTTP server. It comes in the form of an Apache, Nginx or IIS module that analyzes incoming requests by using a database of rules for requests considered undesirable.<\/span><\/p>

Source: Wikipedia<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Intelligence X<\/a><\/strong> is an independent European technology company, its mission is to develop and maintain the search engine and data archive. It searches in places such as the darknet, document sharing platforms, whois data, public data leaks and more.<\/p>

Source: Intelx.io<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Functional diagram<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Automatic recovery of leaked passwords<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Description\u200b<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The objectives of the python script are to recover all the leaked and known passwords of the IntelligenceX platform.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Configuration<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
# touch \/etc\/httpd\/modsecurity.d\/leaked_password.txt
# vi \/opt\/intelx_ModSec.py<\/pre>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
# -*- coding: utf-8 -*-
import http.client
import json
import ssl
import requests
import os
import platform

from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

### Variables
API=\"*****\"
INTELX_URL=\"3.intelx.io\"
DOMAIN=\"mydomain.tld\"
PASSWD_FILE=\"\/etc\/httpd\/modsecurity.d\/leaked_password.txt\"

def reloadHttp():
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ### Dirty, but we're fine with it
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 configtest = os.system('sudo service httpd configtest')
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if configtest == 0:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 os.system('sudo service httpd reload')

def main():
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ### Init password list
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 myPassword = []

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ### Get all password
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 url = 'https:\/\/'+INTELX_URL+'\/accounts\/1?selector='+DOMAIN+'&limit=1000000'

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 headers = {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 'X-Key': API
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 response = requests.request(\"GET\", url, headers=headers, verify=False)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 intelx_result = json.loads(response.text.encode('utf8'))

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 for leak in intelx_result:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if leak[\"passwordtype\"] == \"Plaintext\":
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if leak[\"password\"] not in myPassword:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 myPassword.append(leak[\"password\"])

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 myPassword_sorted = sorted(myPassword)

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ### Get all password in current file
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 with open(PASSWD_FILE) as f:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 lines = f.read().splitlines()

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ### Compare both lists for any changes
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 temp_1 = set(myPassword_sorted)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 temp_2 = set(lines)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if temp_1 != temp_2:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 with open(PASSWD_FILE, \"w\") as fp:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0for password in myPassword_sorted:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 fp.write(\"%s\\n\" % password)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 reloadHttp()

if __name__ == '__main__':
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 main()<\/pre>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Automatisation<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
# crontab -e
00\u00a0\u00a0\u00a0\u00a0\u00a0 00\u00a0\u00a0\u00a0\u00a0\u00a0 *\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 python3 \/opt\/intelx_ModSec.py > \/dev\/null 2>&1<\/pre>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
ModSecurity setup<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Description\u200b<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
We will configure ModSecurity to fetch the password from the database of passwords retrieved from IntelligenceX via the script. The rule below does :<\/p>
    • Fires if the URL called is \u201c\/secure\/login\u201d and the method is POST<\/li>
    • Compares the value of the Password argument to our file<\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t
      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t
      Configuration<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t
      ### 120 - Sec rule to block leaked password usage
      SecRule REQUEST_URI ^\\\/secure\\\/login \"chain,phase:2,t:none,t:lowercase,t:normalisePath,t:urlDecode,t:urlDecodeUni,t:utf8toUnicode,id:120,log,deny,msg:'Leaked Password Usage'\"
      \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SecRule REQUEST_METHOD \"^POST\" \"chain,t:none\"
       \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SecRule ARGS:Password \"@pmFromFile \/etc\/httpd\/modsecurity.d\/leaked_password.txt\" \"t:none\"<\/pre>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t
      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t\t
      \n\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t
      Functional validation<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t
      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t
      BURP<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t
      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t
      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t
      ModSecurity logs<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t
      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t
      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t\t
      \n\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t
      Conclusion<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t
      The integration of the information present in the data leaks and collected by IntelligenceX is made very simple thanks to the API. The script can also be modified to connect to various other leak sources and integrated into a WAF using the same principle.<\/font><\/p>\n
      In addition, ModSecurity logs can be integrated into your preferred SIEM or SOAR solution to trigger actions when this rule is triggered:<\/font><\/p>\n
        \n
      • \n
          \n
        • SOC alert<\/li>\n
        • TIP Enrichment<\/font><\/li>
        • Etc<\/span><\/font>
          <\/li>\n<\/ul>\n<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t
          \n\t\t\t
          <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t
          Use in the context of a SOC\/CSIRT<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t
          \n\t\t\t
          <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"
          Introduction Background and objectives Data leaks are becoming more and more numerous and the data contained more and more critical (PHI, PII, Password, \u2026.). Although necessary, the use of a password manager alone is no longer sufficient. Breaches can come from many sources, and even from the password manager itself. It is therefore essential to […]<\/p>\n","protected":false},"author":1,"featured_media":11030,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[95,96,98],"tags":[],"class_list":["post-15075","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybers-news","category-news-en-2","category-security-en-2"],"_links":{"self":[{"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/posts\/15075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/comments?post=15075"}],"version-history":[{"count":5,"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/posts\/15075\/revisions"}],"predecessor-version":[{"id":15082,"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/posts\/15075\/revisions\/15082"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/media\/11030"}],"wp:attachment":[{"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/media?parent=15075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/categories?post=15075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cheops-technology.ch\/en\/wp-json\/wp\/v2\/tags?post=15075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}