id: browserless-debugger info: name: Exposed Browserless debugger author: ggranjus severity: medium description: Browserless instance can be used to make web requests. May worth checking /workspace for juicy files. reference: - https://docs.browserless.io/docs/docker.html#securing-your-instance metadata: max-request: 1 shodan-query: http.title:"browserless debugger" tags: browserless,unauth,debug,misconfig http: - method: GET path: - "{{BaseURL}}" matchers-condition: and matchers: - type: word part: body words: - "browserless debugger" - "Click the ► button to run your code." condition: or - type: status status: - 200 # digest: 4b0a00483046022100fbc099737ef182029191e896b9806e610a162693a38bcbf4fabd84a3a064ce64022100cb27dd4e8aa539c21facd415d9a3d360e356988d5e4a4f33d57178e4d1602959:922c64590222798bb761d5b6d8e72950