nuclei-templates/http/misconfiguration/server-status-localhost.yaml

id: server-status-localhost

info:
  name: Server Status Disclosure
  author: pdteam,geeknik
  severity: low
  tags: apache,debug
  metadata:
    max-request: 1

http:
  - method: GET
    headers:
      Forwarded: "127.0.0.1"
      X-Client-IP: "127.0.0.1"
      X-Forwarded-By: "127.0.0.1"
      X-Forwarded-For: "127.0.0.1"
      X-Forwarded-For-IP: "127.0.0.1"
      X-Forwarded-Host: "127.0.0.1"
      X-Host: "127.0.0.1"
      X-Originating-IP: "127.0.0.1"
      X-Remote-Addr: "127.0.0.1"
      X-Remote-IP: "127.0.0.1"
      X-True-IP: "127.0.0.1"

    path:
      - "{{BaseURL}}/server-status"

    matchers:
      - type: word
        words:
          - "Apache Server Status"
          - "Server Version"
        condition: and