Create glpi-directory-listing.yaml (#3439)

* Create glpi-directory-listing.yaml * Linting * Linting Adds ``part: header`` * Update glpi-directory-listing.yaml * Update glpi-directory-listing.yaml * Update glpi-directory-listing.yaml * Update glpi-directory-listing.yaml * Update glpi-directory-listing.yaml * Update glpi-directory-listing.yaml * Update glpi-directory-listing.yaml Co-authored-by: Sandeep Singh <sandeep@projectdiscovery.io> Co-authored-by: Prince Chaddha <prince@projectdiscovery.io>
2021-12-30 08:35:45 +00:00 · 2021-12-30 08:35:45 +00:00 · 9923e91348
parent 99741d1e5f
commit 9923e91348
1 changed files with 30 additions and 0 deletions
--- a/misconfiguration/glpi-directory-listing.yaml
+++ b/misconfiguration/glpi-directory-listing.yaml
@ -0,0 +1,30 @@
+id: glpi-directory-listing
+
+info:
+  name: GLPI Directory Listing
+  author: RedTeamBrasil,ImNightmaree
+  description: In certain cases, system administrators leave directory listing enabled which can sometimes expose sensitive files.
+  severity: low
+  tags: glpi,misconfig
+
+requests:
+  - raw:
+      - |
+        GET {{expose_data}} HTTP/1.1
+        Host: {{Hostname}}
+
+    payloads:
+      expose_data:
+        - /glpi/files/
+        - /glpi/
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Index of /glpi/"
+
+      - type: status
+        status:
+          - 200