id: server-status-localhost
info:
name: Server Status Disclosure
author: pdteam,geeknik
severity: low
metadata:
max-request: 1
tags: apache,debug,misconfig
http:
- method: GET
headers:
Forwarded: "127.0.0.1"
X-Client-IP: "127.0.0.1"
X-Forwarded-By: "127.0.0.1"
X-Forwarded-For: "127.0.0.1"
X-Forwarded-For-IP: "127.0.0.1"
X-Forwarded-Host: "127.0.0.1"
X-Host: "127.0.0.1"
X-Originating-IP: "127.0.0.1"
X-Remote-Addr: "127.0.0.1"
X-Remote-IP: "127.0.0.1"
X-True-IP: "127.0.0.1"
path:
- "{{BaseURL}}/server-status"
matchers:
- type: word
words:
- "Apache Server Status"
- "Server Version"
condition: and
