Merge pull request #1444 from DhiyaneshGeek/master

PHP Debug bar,SAP Directory Listing,Unauthenticated Netdata,Zippkin Unauth

exposures/logs/php-debug-bar.yaml

@@ -0,0 +1,30 @@
+id: php-debug-bar
+info:
+  name: PHP Debug bar
+  author: dhiyaneshDk
+  severity: high
+  tags: debug,logs,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_debugbar/open?max=20&offset=0"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"id":"'
+          - '"datetime":'
+          - '"method"'
+        condition: and
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header

misconfiguration/sap-directory-listing.yaml

@@ -0,0 +1,29 @@
+id: sap-directory-listing
+
+info:
+  name: SAP Directory Listing
+  author: dhiyaneshDK
+  severity: medium
+  tags: sap,listing,misconfig
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/irj/go/km/navigation/'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'title="~system"'
+          - 'NetWeaver'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

misconfiguration/unauthenticated-netdata.yaml

@@ -0,0 +1,30 @@
+id: unauthenticated-netdata
+
+info:
+  name: Unauthenticated Netdata
+  author: dhiyaneshDk
+  severity: medium
+  reference: https://github.com/netdata/netdata
+  tags: netdata,unauth,misconfig
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/v1/data?chart=system.cpu&format=json&points=125&group=average&gtime=0&options=ms%7Cflip%7Cjsonwrap%7Cnonzero&after=-120&dimensions=iowait"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "view_update_every"
+          - "dimensions"
+        condition: and
+
+      - type: word
+        words:
+          - "application/json"
+        part: header

misconfiguration/unauthenticated-zippkin.yaml

@@ -0,0 +1,31 @@
+id: unauthenticated-zippkin
+
+info:
+  name: Unauthenticated Zippkin
+  author: dhiyaneshDk
+  severity: high
+  description: Unauthenticated access to Zippkin
+  tags: unauth
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/config.json"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'application/json'
+        part: header
+
+      - type: word
+        words:
+          - environment
+          - defaultLookback
+        part: body
+        condition: and