id: php-debugbar-exposure

info:
  name: Php Debug Bar - Exposure
  author: ritikchaddha,pdteam
  severity: medium
  description: |
    The DebugBar integrates easily in any projects and can display profiling data from any part of your application. It comes built-in with data collectors for standard PHP features and popular projects.
  reference:
    - https://hackerone.com/reports/1883806
    - http://phpdebugbar.com/
    - https://github.com/maximebf/php-debugbar
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"phpdebugbar"
  tags: hackerone,misconfig,php,phpdebug,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/_debugbar/open"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_1, "phpdebugbar") && contains(body, "widget")'
          - 'contains_all(body_2, "\"utime\"","\"datetime\"","{\"id") && contains(content_type_2, "application/json")'
        condition: or

# digest: 4a0a00473045022055cb94f2a7454c92dcfed134429b31582f5c4e40bd7915cb109f7e28c7d3c533022100f1b29be9749442a2831ed29e39e61e64b9050dfa755a41ec6bc38abf7abab8d0:922c64590222798bb761d5b6d8e72950