diff --git a/cves/jira-cve-2017-9506.yaml b/cves/jira-cve-2017-9506.yaml new file mode 100644 index 0000000000..b82551cf65 --- /dev/null +++ b/cves/jira-cve-2017-9506.yaml @@ -0,0 +1,16 @@ +id: jira-cve-2017-9506 + +info: + name: Jira IconURIServlet SSRF + author: Ice3man + severity: high + +requests: + - method: GET + path: + - "{{BaseURL}}/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json" + matchers: + - type: word + words: + - "ipinfo.io/missingauth" + part: body diff --git a/files/git-config.yaml b/files/git-config.yaml new file mode 100644 index 0000000000..4cddf21641 --- /dev/null +++ b/files/git-config.yaml @@ -0,0 +1,15 @@ +id: git-config + +info: + name: Git Config Disclosure + author: Ice3man + severity: medium + +requests: + - method: GET + path: + - "{{BaseURL}}/.git/config" + matchers: + - type: word + words: + - "[core]" diff --git a/files/phpinfo.yaml b/files/phpinfo.yaml new file mode 100644 index 0000000000..0bc41894c3 --- /dev/null +++ b/files/phpinfo.yaml @@ -0,0 +1,20 @@ +id: phpinfo-files + +info: + name: phpinfo Disclosure + author: bauthard + severity: low + +requests: + - method: GET + path: + - "{{BaseURL}}/php.php" + - "{{BaseURL}}/phpinfo.php" + - "{{BaseURL}}/info.php" + - "{{BaseURL}}/_profiler/phpinfo" + matchers: + - type: word + words: + - "PHP Extension" + - "PHP Version" + condition: and \ No newline at end of file diff --git a/files/server-status-localhost.yaml b/files/server-status-localhost.yaml new file mode 100644 index 0000000000..9f220b0f83 --- /dev/null +++ b/files/server-status-localhost.yaml @@ -0,0 +1,24 @@ +id: server-status-localhost + +info: + name: Server Status Disclosure + author: bauthard + severity: low + +requests: + - method: GET + # Example of sending some headers to the servers + headers: + X-Client-IP: "127.0.0.1" + X-Remote-IP: "127.0.0.1" + X-Remote-Addr: "127.0.0.1" + X-Forwarded-For: "127.0.0.1" + X-Originating-IP: "127.0.0.1" + path: + - "{{BaseURL}}/server-status" + matchers: + - type: word + words: + - "Apache Server Status" + - "Server Version" + condition: and diff --git a/panels/phpmyadmin-panel.yaml b/panels/phpmyadmin-panel.yaml new file mode 100644 index 0000000000..6873573bf3 --- /dev/null +++ b/panels/phpmyadmin-panel.yaml @@ -0,0 +1,15 @@ +id: phpmyadmin-panel + +info: + name: phpMyAdmin Panel + author: bauthard + severity: low + +requests: + - method: GET + path: + - "{{BaseURL}}/phpmyadmin/" + matchers: + - type: word + words: + - "phpMyAdmin" diff --git a/panels/swagger-panel.yaml b/panels/swagger-panel.yaml new file mode 100644 index 0000000000..b16eb9d6b2 --- /dev/null +++ b/panels/swagger-panel.yaml @@ -0,0 +1,23 @@ +id: swagger-panel + +info: + name: Swagger API Panel + author: Ice3man + severity: low + +requests: + - method: GET + path: + - "{{BaseURL}}/swagger/index.html" + - "{{BaseURL}}/swagger-ui.html" + - "{{BaseURL}}/swagger/swagger-ui.html" + - "{{BaseURL}}/api/swagger-ui.html" + - "{{BaseURL}}/api-docs/swagger.json" + - "{{BaseURL}}/swagger.json" + - "{{BaseURL}}/swagger/v1/swagger.json" + matchers: + - type: word + words: + - "\"swagger\":" + - "Swagger UI" + condition: or diff --git a/technologies/citrix-vpn-detect.yaml b/technologies/citrix-vpn-detect.yaml new file mode 100644 index 0000000000..f90ce96161 --- /dev/null +++ b/technologies/citrix-vpn-detect.yaml @@ -0,0 +1,15 @@ +id: citrix-vpn-detect + +info: + name: Citrix VPN Detection + author: bauthard + severity: low + +requests: + - method: GET + path: + - "{{BaseURL}}/vpn/index.html" + matchers: + - type: word + words: + - "Citrix Gateway" diff --git a/technologies/jenkins-headers-detect.yaml b/technologies/jenkins-headers-detect.yaml new file mode 100644 index 0000000000..00c64db11d --- /dev/null +++ b/technologies/jenkins-headers-detect.yaml @@ -0,0 +1,16 @@ +id: jenkins-headers-detect + +info: + name: Jenkins Headers Based Detection + author: ice3man + severity: low + +requests: + - method: GET + path: + - "{{BaseURL}}/" + matchers: + - type: word + words: + - "X-Jenkins" + part: header diff --git a/technologies/jira-detect.yaml b/technologies/jira-detect.yaml new file mode 100644 index 0000000000..0b6efc607d --- /dev/null +++ b/technologies/jira-detect.yaml @@ -0,0 +1,16 @@ +id: jira-detect + +info: + name: Detect Jira Issue Management Software + author: bauthard + severity: low + +requests: + - method: GET + path: + - "{{BaseURL}}/secure/Dashboard.jspa" + - "{{BaseURL}}/jira/secure/Dashboard.jspa" + matchers: + - type: word + words: + - "Project Management Software"