id: php-debugbar-exposure

info:
  name: Php Debug Bar - Exposure
  author: ritikchaddha,pdteam
  severity: medium
  description: |
    The DebugBar integrates easily in any projects and can display profiling data from any part of your application. It comes built-in with data collectors for standard PHP features and popular projects.
  reference:
    - https://hackerone.com/reports/1883806
    - http://phpdebugbar.com/
    - https://github.com/maximebf/php-debugbar
  metadata:
    max-request: 2
    verified: true
    shodan-query: html:"phpdebugbar"
  tags: misconfig,php,phpdebug,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/_debugbar/open"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_1, "phpdebugbar") && contains(body, "widget")'
          - 'contains_all(body_2, "\"utime\"","\"datetime\"","{\"id")'
        condition: or