diff --git a/misconfiguration/gitlab-public-repos.yaml b/misconfiguration/gitlab-public-repos.yaml new file mode 100644 index 0000000000..3cd735f700 --- /dev/null +++ b/misconfiguration/gitlab-public-repos.yaml @@ -0,0 +1,27 @@ +id: gitlab-snippets +info: + name: GitLab public repositories + author: ldionmarcil + severity: info + reference: | + - https://twitter.com/ldionmarcil/status/1370052344562470922 + - https://github.com/ldionmarcil/gitlab-unauth-parser + +requests: + - method: GET + path: + - "{{BaseURL}}/api/v4/projects" + headers: + Cookie: _gitlab_session= + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "Set-Cookie: _gitlab_session=" + + - type: word + part: body + words: + - "name_with_namespace"