diff --git a/exposures/files/jetbrains-webservers.yaml b/exposures/files/jetbrains-webservers.yaml new file mode 100644 index 0000000000..171600663d --- /dev/null +++ b/exposures/files/jetbrains-webservers.yaml @@ -0,0 +1,43 @@ +id: jetbrains-webservers + +info: + name: Jetbrains WebServers File Exposure + author: geeknik + severity: low + description: | + Created by Jetbrains IDEs, contains webserver credentials with encoded passwords. + reference: + - https://www.exploit-db.com/ghdb/6648 + metadata: + verified: true + shodan-query: title:"Backpack Admin" + tags: jetbrains,config,edb + +requests: + - method: GET + path: + - "{{BaseURL}}/.idea/WebServers.xml" + - "{{BaseURL}}/.idea/webServers.xml" + - "{{BaseURL}}/.idea/webservers.xml" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + condition: and + + - type: word + part: header + words: + - "application/xml" + - "text/xml" + condition: or + + - type: status + status: + - 200