id: server-status-localhost

info:
  name: Server Status Disclosure
  author: pdteam,geeknik
  severity: low
  metadata:
    max-request: 1
  tags: apache,debug,misconfig

http:
  - method: GET

    headers:
      Forwarded: "127.0.0.1"
      X-Client-IP: "127.0.0.1"
      X-Forwarded-By: "127.0.0.1"
      X-Forwarded-For: "127.0.0.1"
      X-Forwarded-For-IP: "127.0.0.1"
      X-Forwarded-Host: "127.0.0.1"
      X-Host: "127.0.0.1"
      X-Originating-IP: "127.0.0.1"
      X-Remote-Addr: "127.0.0.1"
      X-Remote-IP: "127.0.0.1"
      X-True-IP: "127.0.0.1"
    path:
      - "{{BaseURL}}/server-status"

    matchers:
      - type: word
        words:
          - "Apache Server Status"
          - "Server Version"
        condition: and
# digest: 4a0a00473045022100c411023e34054467c57cee8db90af210cdd995a4ab0006124be068ce2b5942a0022029d786a46f67f4a72dbab9623f9b64f2ba32f72ffbf4247537ecd27878c18f7f:922c64590222798bb761d5b6d8e72950