id: clockwork-php-page info: name: Clockwork PHP page exposure author: organiccrap severity: high # https://twitter.com/damian_89_/status/1250721398747791360 requests: - method: GET path: - '{{BaseURL}}/__clockwork/app' headers: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 matchers-condition: and matchers: - type: status status: - 200 - type: word words: - Clockwork - part: body condition: or