daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added conditional word in body 

I found this be a valid finding /actuator/env on a production host but was missing additional words to check which was causing a false negative. 'activeProfiles' allows this test to pass on the instance that I came across.
patch-1
r3naissance 2021-06-09 11:36:54 -06:00 committed by GitHub
parent f0f6d26bec
commit aa9e899dd2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
misconfiguration/springboot/springboot-env.yaml
View File

@ -18,6 +18,8 @@ requests:
part: body
words:
- "applicationConfig"
- "activeProfiles"
condition: or
- type: word
part: body