nuclei-templates/exposures/configs/javascript-env.yaml

id: javascript-env

info:
  name: JavaScript Environment Config
  author: pdp,geeknik
  severity: low
  description: Detects common JavaScript environment configuration files.
  tags: javascript,config,exposure

requests:
  - method: GET
    path:
      - "{{BaseURL}}/env.js"
      - "{{BaseURL}}/env.development.js"
      - "{{BaseURL}}/env.production.js"
      - "{{BaseURL}}/env.test.js"
      - "{{BaseURL}}/env.dev.js"
      - "{{BaseURL}}/env.prod.js"

    matchers-condition: and
    matchers:

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - "contains(tolower(all_headers), 'content-type: application/javascript')"

      - type: word
        part: body
        words:
          - "module.exports"
          - "const audience"
          - "const domain"
          - "NODE_ENV"
          - "LOG_LEVEL"
          - "TOKEN"
          - "KEY"
          - "PASSWORD"
          - "VERSION"
        condition: or

      - type: word
        part: body
        words:
          - "Bootstrap"
          - "jQuery"
          - "CSS TRANSITION SUPPORT"
        condition: or
        negative: true