id: codeigniter-env
info:
name: Codeigniter - .env File Discovery
author: emenalf
severity: high
description: Codeigniter .env file was discovered.
metadata:
max-request: 12
tags: config,exposure,codeigniter
http:
- method: GET
path:
- "{{BaseURL}}{{paths}}"
payloads:
paths:
- "/.env"
- "/.env.dev.local"
- "/.env.development.local"
- "/.env.prod.local"
- "/.env.production.local"
- "/.env.local"
- "/.env.example"
- "/.env.stage"
- "/.env.live"
- "/.env_1"
- "/.env.old"
- "/.env_sample"
matchers-condition: and
matchers:
- type: regex
regex:
- "(?m)^APP_(NAME|ENV|KEY|DEBUG|URL|PASSWORD)"
- "(?m)^DB_(HOST|PASSWORD|DATABASE)"
condition: or
- type: status
status:
- 200
# digest: 4a0a0047304502206d6e78826d4ac6f8c173b6343594f6a6a5f5c2a24a062e20442d8d1c5b43b553022100da4b4e0f4ce7f5e74b664019f89e1c5b6144c59b73202b55720025f63e51560d:922c64590222798bb761d5b6d8e72950
