updated with path variable

http/exposures/files/generic-db.yaml

@@ -42,104 +42,107 @@ info:
     cvss-score: 7.5
   metadata:
     max-request: 89
-  tags: files,database,exposure,sqlite,sqlite3
+  tags: files,database,exposure,sqlite,sqlite3,fuzz
 
 http:
   - method: GET
     path:
-      # Recommended paths found in framework official docs or unofficial tutorials
-      - "{{BaseURL}}/database/database.sqlite"
-      - "{{BaseURL}}/database/production.sqlite"
-      - "{{BaseURL}}/app/database/production.sqlite"
-      - "{{BaseURL}}/writable/db.sqlite3"
-      - "{{BaseURL}}/writable/database.db"
-      - "{{BaseURL}}/var/app.db"
-      - "{{BaseURL}}/var/data/db.sqlite"
-      - "{{BaseURL}}/var/data/data.sqlite"
-      - "{{BaseURL}}/app/sqlite.db"
-      - "{{BaseURL}}/sqlite.db"
-      - "{{BaseURL}}/db.sqlite3"
-      - "{{BaseURL}}/db/production.sqlite3"
-      - "{{BaseURL}}/db.sqlite"
-      - "{{BaseURL}}/mydb.sqlite"
-      - "{{BaseURL}}/app/data/app_db.sqlite"
-      - "{{BaseURL}}/app/webroot/database.sqlite"
-      - "{{BaseURL}}/app/database.sqlite"
-      - "{{BaseURL}}/application/databases/db.sqlite"
-      - "{{BaseURL}}/application/db/database.sqlite"
-      - "{{BaseURL}}/application/Database/db1.db"
-      - "{{BaseURL}}/application/database/data.db"
-      - "{{BaseURL}}/data/app.db"
-      - "{{BaseURL}}/data/sqlite.db"
-      - "{{BaseURL}}/data/sqlite3.db"
-      - "{{BaseURL}}/data/database.db"
-      - "{{BaseURL}}/data/production.db"
-      - "{{BaseURL}}/storage/database/database.sqlite"
-      - "{{BaseURL}}/protected/data/app.db"
-      - "{{BaseURL}}/protected/data/sqlite.db"
-      - "{{BaseURL}}/protected/data/sqlite3.db"
-      - "{{BaseURL}}/protected/data/database.db"
-      - "{{BaseURL}}/protected/data/production.db"
-      - "{{BaseURL}}/db/database.db"
-      - "{{BaseURL}}/db/database.sqlite"
-      - "{{BaseURL}}/app/Model/app.db"
-      - "{{BaseURL}}/app/Model/sqlite.db"
-      - "{{BaseURL}}/app/Model/sqlite3.db"
-      - "{{BaseURL}}/app/Model/database.db"
-      - "{{BaseURL}}/app/Model/production.db"
 
-      # General paths
-      - "{{BaseURL}}/app.db"
-      - "{{BaseURL}}/sqlite3.db"
-      - "{{BaseURL}}/app.sqlite"
-      - "{{BaseURL}}/app.sqlite3"
-      - "{{BaseURL}}/database.db"
-      - "{{BaseURL}}/database.sqlite"
-      - "{{BaseURL}}/database.sqlite3"
-      - "{{BaseURL}}/production.db"
-      - "{{BaseURL}}/production.sqlite"
-      - "{{BaseURL}}/production.sqlite3"
-      - "{{BaseURL}}/db/db.sqlite"
-      - "{{BaseURL}}/db/db.sqlite3"
-      - "{{BaseURL}}/db/sqlite.db"
-      - "{{BaseURL}}/db/sqlite3.db"
-      - "{{BaseURL}}/db/app.db"
-      - "{{BaseURL}}/db/app.sqlite"
-      - "{{BaseURL}}/db/app.sqlite3"
-      - "{{BaseURL}}/db/database.sqlite3"
-      - "{{BaseURL}}/db/production.db"
-      - "{{BaseURL}}/db/production.sqlite"
-      - "{{BaseURL}}/app/db.sqlite"
-      - "{{BaseURL}}/app/db.sqlite3"
-      - "{{BaseURL}}/app/sqlite3.db"
-      - "{{BaseURL}}/app/app.db"
-      - "{{BaseURL}}/app/app.sqlite"
-      - "{{BaseURL}}/app/app.sqlite3"
-      - "{{BaseURL}}/app/database.db"
-      - "{{BaseURL}}/app/database.sqlite3"
-      - "{{BaseURL}}/app/production.db"
-      - "{{BaseURL}}/app/production.sqlite"
-      - "{{BaseURL}}/app/production.sqlite3"
-      - "{{BaseURL}}/data/db.sqlite"
-      - "{{BaseURL}}/data/db.sqlite3"
-      - "{{BaseURL}}/data/app.sqlite"
-      - "{{BaseURL}}/data/app.sqlite3"
-      - "{{BaseURL}}/data/database.sqlite"
-      - "{{BaseURL}}/data/database.sqlite3"
-      - "{{BaseURL}}/data/production.sqlite"
-      - "{{BaseURL}}/data/production.sqlite3"
-      - "{{BaseURL}}/database/db.sqlite"
-      - "{{BaseURL}}/database/db.sqlite3"
-      - "{{BaseURL}}/database/sqlite.db"
-      - "{{BaseURL}}/database/sqlite3.db"
-      - "{{BaseURL}}/database/app.db"
-      - "{{BaseURL}}/database/app.sqlite"
-      - "{{BaseURL}}/database/app.sqlite3"
-      - "{{BaseURL}}/database/database.db"
-      - "{{BaseURL}}/database/database.sqlite3"
-      - "{{BaseURL}}/database/production.db"
-      - "{{BaseURL}}/database/production.sqlite3"
+      - "{{BaseURL}}/{{path}}"
 
+    payloads:
+      path:
+        - database/database.sqlite
+        - database/production.db
+        - database/production.sqlite
+        - database/production.sqlite3
+        - app/database/production.sqlite
+        - writable/db.sqlite3
+        - writable/database.db
+        - var/app.db
+        - var/data/db.sqlite
+        - var/data/data.sqlite
+        - app/sqlite.db
+        - sqlite.db
+        - db.sqlite3
+        - db/production.sqlite3
+        - db.sqlite
+        - mydb.sqlite
+        - app/data/app_db.sqlite
+        - app/webroot/database.sqlite
+        - app/database.sqlite
+        - application/databases/db.sqlite
+        - application/db/database.sqlite
+        - application/Database/db1.db
+        - application/database/data.db
+        - data/app.db
+        - data/sqlite.db
+        - data/sqlite3.db
+        - data/database.db
+        - data/production.db
+        - storage/database/database.sqlite
+        - protected/data/app.db
+        - protected/data/sqlite.db
+        - protected/data/sqlite3.db
+        - protected/data/database.db
+        - protected/data/production.db
+        - db/database.db
+        - db/database.sqlite
+        - app/Model/app.db
+        - app/Model/sqlite.db
+        - app/Model/sqlite3.db
+        - app/Model/database.db
+        - app/Model/production.db
+        - app.db
+        - sqlite3.db
+        - app.sqlite
+        - app.sqlite3
+        - database.db
+        - database.sqlite
+        - database.sqlite3
+        - production.db
+        - production.sqlite
+        - production.sqlite3
+        - db/db.sqlite
+        - db/db.sqlite3
+        - db/sqlite.db
+        - db/sqlite3.db
+        - db/app.db
+        - db/app.sqlite
+        - db/app.sqlite3
+        - db/database.sqlite3
+        - db/production.db
+        - db/production.sqlite
+        - app/db.sqlite
+        - app/db.sqlite3
+        - app/sqlite3.db
+        - app/app.db
+        - app/app.sqlite
+        - app/app.sqlite3
+        - app/database.db
+        - app/database.sqlite3
+        - app/production.db
+        - app/production.sqlite
+        - app/production.sqlite3
+        - data/db.sqlite
+        - data/db.sqlite3
+        - data/app.sqlite
+        - data/app.sqlite3
+        - data/database.sqlite
+        - data/database.sqlite3
+        - data/production.sqlite
+        - data/production.sqlite3
+        - database/db.sqlite
+        - database/db.sqlite3
+        - database/sqlite.db
+        - database/sqlite3.db
+        - database/app.db
+        - database/app.sqlite
+        - database/app.sqlite3
+        - database/database.db
+        - database/database.sqlite3
+
+    stop-at-first-match: true
     matchers:
       - type: dsl
         dsl: