2021-01-09 13:02:04 +00:00
|
|
|
id: wadl-api
|
2020-04-06 12:27:09 +00:00
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: wadl file disclosure
|
2020-08-06 19:51:37 +00:00
|
|
|
author: 0xrudra & manuelbua
|
2020-08-03 21:52:00 +00:00
|
|
|
severity: info
|
2020-04-06 12:27:09 +00:00
|
|
|
|
2020-08-29 12:15:51 +00:00
|
|
|
# References:
|
|
|
|
|
# - https://github.com/dwisiswant0/wadl-dumper
|
|
|
|
|
# - https://www.nopsec.com/leveraging-exposed-wadl-xml-in-burp-suite/
|
|
|
|
|
|
2020-04-06 12:27:09 +00:00
|
|
|
requests:
|
|
|
|
|
- method: GET
|
2020-05-25 08:02:27 +00:00
|
|
|
path:
|
2020-04-06 12:27:09 +00:00
|
|
|
- "{{BaseURL}}/application.wadl"
|
2020-08-06 18:26:49 +00:00
|
|
|
- "{{BaseURL}}/application.wadl?detail=true"
|
|
|
|
|
- "{{BaseURL}}/api/application.wadl"
|
|
|
|
|
- "{{BaseURL}}/api/v1/application.wadl"
|
|
|
|
|
- "{{BaseURL}}/api/v2/application.wadl"
|
2020-04-06 12:27:09 +00:00
|
|
|
matchers:
|
2020-08-06 18:26:49 +00:00
|
|
|
- name: http-get
|
|
|
|
|
type: word
|
|
|
|
|
words:
|
|
|
|
|
- "This is simplified WADL with user and core resources only"
|
|
|
|
|
- "\"http://jersey.java.net/\""
|
|
|
|
|
- "http://wadl.dev.java.net/2009/02"
|
|
|
|
|
condition: or
|
|
|
|
|
part: body
|
|
|
|
|
- method: OPTIONS
|
|
|
|
|
path:
|
2021-01-13 07:31:46 +00:00
|
|
|
- "{{BaseURL}}"
|
2020-08-06 18:26:49 +00:00
|
|
|
- "{{BaseURL}}/api/v1"
|
|
|
|
|
- "{{BaseURL}}/api/v2"
|
|
|
|
|
matchers:
|
|
|
|
|
- name: http-options
|
|
|
|
|
type: word
|
2020-05-25 08:02:27 +00:00
|
|
|
words:
|
2020-04-06 12:27:09 +00:00
|
|
|
- "This is simplified WADL with user and core resources only"
|
2020-04-06 12:28:11 +00:00
|
|
|
- "\"http://jersey.java.net/\""
|
2020-04-06 12:27:09 +00:00
|
|
|
- "http://wadl.dev.java.net/2009/02"
|
|
|
|
|
condition: or
|
|
|
|
|
part: body
|
