Generic .env detector

exposures/configs/env.yaml

@@ -0,0 +1,45 @@
+id: env
+
+info:
+  name: Env file - Sensitive Information Disclosure
+  severity: high
+  description: |
+    A .env file was discovered containing sensitive information like database credentials and tokens. It should not be publicly accessible.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
+    cvss-score: 8.3
+    cwe-id: CWE-522
+  tags: config,exposure,environment
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.env"
+      - "{{BaseURL}}/.env.bak"
+      - "{{BaseURL}}/.env.dev"
+      - "{{BaseURL}}/.env.dev.local"
+      - "{{BaseURL}}/.env.development.local"
+      - "{{BaseURL}}/.env.prod"
+      - "{{BaseURL}}/.env.prod.local"
+      - "{{BaseURL}}/.env.production"
+      - "{{BaseURL}}/.env.production.local"
+      - "{{BaseURL}}/.env.local"
+      - "{{BaseURL}}/.env.example"
+      - "{{BaseURL}}/.env.stage"
+      - "{{BaseURL}}/.env.live"
+      - "{{BaseURL}}/.env.backup"
+      - "{{BaseURL}}/.env.save"
+      - "{{BaseURL}}/.env.old"
+      - "{{BaseURL}}/.env.www"
+      - "{{BaseURL}}/.env_1"
+      - "{{BaseURL}}/.env_sample"
+      - "{{BaseURL}}/.env.{{DN}}"
+      - "{{BaseURL}}/.env.{{SD}}"
+      - "{{BaseURL}}/api/.env"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "(?mi)^[a-z_]*(KEY|TOKEN|PASS|SECRET|DB_URL|DATABASE_URL|MAILER_URL)[a-z_]*="