id: iis-internal-ip-disclosure

info:
  name: IIS Internal IP Disclosure Template
  author: WillD96
  severity: info
  tags: iis,misconfig,disclosure
  reference: https://support.kemptechnologies.com/hc/en-us/articles/203522429-How-to-Mitigate-Against-Internal-IP-Address-Domain-Name-Disclosure-In-Real-Server-Redirect

requests:
  - raw:
      - |+
        GET / HTTP/1.0
        Host:
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
        Accept: */*

    unsafe: true # Use Unsafe HTTP library for malformed HTTP requests.
    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '([0-9]{1,3}[\.]){3}[0-9]{1,3}'

      - type: status
        status:
          - 302

    extractors:
      - type: regex
        part: header
        regex:
          - '([0-9]{1,3}[\.]){3}[0-9]{1,3}'