id: tugboat-config-exposure info: name: Tugboat Configuration File Exposure author: geeknik severity: critical description: A Tugboat configuration file was discovered. Tugboat is a command line tool for interacting with DigitalOcean droplets. reference: - https://github.com/petems/tugboat - https://www.digitalocean.com/community/tools/tugboat tags: tugboat,config,exposure requests: - method: GET path: - "{{BaseURL}}/.tugboat" matchers-condition: and matchers: - type: status status: - 200 - type: word words: - "authentication" - "access_token" - "ssh_user" condition: and extractors: - type: regex part: body regex: - 'access_token: .*' # Enhanced by mp on 2022/03/21