nuclei-templates/misconfiguration/shell-history.yaml

id: shell-history

info:
  name: Shell History
  author: pentest_swissky,geeknik
  severity: low
  description: Discover history for bash, ksh, sh, and zsh
  tags: misconfig

requests:
  - method: GET
    max-redirects: 1
    path:
      - "{{BaseURL}}/.bash_history"
      - "{{BaseURL}}/.ksh_history"
      - "{{BaseURL}}/.sh_history"
      - "{{BaseURL}}/.zsh_history"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ls"
          - "mkdir "
          - "chmod "
          - "mv "
          - "nano "
          - "vim "
          - "pico "
          - "sudo "
          - "cd "
          - "cp "
          - "ps aux "
        condition: or

      - type: word
        words:
          - "<?xml"
          - "<env"
          - "application/javascript"
          - "application/json"
          - "application/xml"
          - "html>"
          - "text/html"
        part: response
        negative: true

      - type: status
        status:
          - 200
Shell History (.bash_history) Discover history file for bash and zsh 2020-10-01 18:35:07 +00:00			`id: shell-history`
update shell-history.yaml I don't think this poc needs to be redirected, so I removed 'redirects: true', which will reduce a lot of false positives 2022-08-24 09:47:23 +00:00
Shell History (.bash_history) Discover history file for bash and zsh 2020-10-01 18:35:07 +00:00			`info:`
			`name: Shell History`
Updated author names 2021-06-09 12:20:56 +00:00			`author: pentest_swissky,geeknik`
Update shell-history.yaml 2020-10-03 06:22:40 +00:00			`severity: low`
Update shell-history.yaml 2020-12-02 15:35:28 +00:00			`description: Discover history for bash, ksh, sh, and zsh`
Update shell-history.yaml 2022-08-25 08:06:35 +00:00			`tags: misconfig`
update shell-history.yaml I don't think this poc needs to be redirected, so I removed 'redirects: true', which will reduce a lot of false positives 2022-08-24 09:47:23 +00:00
Shell History (.bash_history) Discover history file for bash and zsh 2020-10-01 18:35:07 +00:00			`requests:`
			`- method: GET`
misc changes 2021-06-06 08:09:16 +00:00			`max-redirects: 1`
Shell History (.bash_history) Discover history file for bash and zsh 2020-10-01 18:35:07 +00:00			`path:`
			`- "{{BaseURL}}/.bash_history"`
Update shell-history.yaml 2020-12-02 15:35:28 +00:00			`- "{{BaseURL}}/.ksh_history"`
			`- "{{BaseURL}}/.sh_history"`
Shell History (.bash_history) Discover history file for bash and zsh 2020-10-01 18:35:07 +00:00			`- "{{BaseURL}}/.zsh_history"`
Update shell-history.yaml 2020-10-03 06:22:40 +00:00
			`matchers-condition: and`
Shell History (.bash_history) Discover history file for bash and zsh 2020-10-01 18:35:07 +00:00			`matchers:`
			`- type: word`
			`words:`
Reduce false positives 2021-07-26 05:53:34 +00:00			`- "ls"`
			`- "mkdir "`
Update shell-history.yaml 2020-10-03 06:22:40 +00:00			`- "chmod "`
Reduce false positives 2021-07-26 05:53:34 +00:00			`- "mv "`
Update shell-history.yaml There are two problems with this template, it only checks for chmod commands but most importantly doesn't check for html tags. A real history file the response doesn't include html tags at all. So, I'm adding two rules: Check for another possible commands (from real example) and adding a negative rule to discard false positives like this one: nuclei -debug -t /home/kali/nuclei-templates/misconfiguration/shell-history.yaml -u http://777.urbanup.com 2021-06-06 02:06:30 +00:00			`- "nano "`
			`- "vim "`
			`- "pico "`
			`- "sudo "`
			`- "cd "`
Reduce false positives 2021-07-26 05:53:34 +00:00			`- "cp "`
Update shell-history.yaml There are two problems with this template, it only checks for chmod commands but most importantly doesn't check for html tags. A real history file the response doesn't include html tags at all. So, I'm adding two rules: Check for another possible commands (from real example) and adding a negative rule to discard false positives like this one: nuclei -debug -t /home/kali/nuclei-templates/misconfiguration/shell-history.yaml -u http://777.urbanup.com 2021-06-06 02:06:30 +00:00			`- "ps aux "`
			`condition: or`
misc changes 2021-06-06 08:09:16 +00:00
Update shell-history.yaml There are two problems with this template, it only checks for chmod commands but most importantly doesn't check for html tags. A real history file the response doesn't include html tags at all. So, I'm adding two rules: Check for another possible commands (from real example) and adding a negative rule to discard false positives like this one: nuclei -debug -t /home/kali/nuclei-templates/misconfiguration/shell-history.yaml -u http://777.urbanup.com 2021-06-06 02:06:30 +00:00			`- type: word`
			`words:`
Update shell-history.yaml Follow-up fix for comment in #2129 2021-09-17 15:00:22 +00:00			`- "<?xml"`
			`- "<env"`
Update shell-history.yaml fix false positive 2021-07-21 17:26:20 +00:00			`- "application/javascript"`
Reduce false positives 2021-07-26 05:53:34 +00:00			`- "application/json"`
			`- "application/xml"`
more strict matcher 2021-06-26 14:12:11 +00:00			`- "html>"`
			`- "text/html"`
parts update to use response instead of all 2022-04-20 14:38:07 +00:00			`part: response`
Update shell-history.yaml There are two problems with this template, it only checks for chmod commands but most importantly doesn't check for html tags. A real history file the response doesn't include html tags at all. So, I'm adding two rules: Check for another possible commands (from real example) and adding a negative rule to discard false positives like this one: nuclei -debug -t /home/kali/nuclei-templates/misconfiguration/shell-history.yaml -u http://777.urbanup.com 2021-06-06 02:06:30 +00:00			`negative: true`
Update shell-history.yaml 2022-08-25 08:06:35 +00:00
			`- type: status`
			`status:`
			`- 200`