nuclei-templates/security-misconfiguration/wordpress-accessible-wpconf...

27 lines
810 B
YAML

id: wordpress-accessible-wpconfig
info:
name: WordPress accessible wp-config
author: Kiblyn11 & zomsop82 & madrobot & geeknik
severity: high
requests:
- method: GET
path:
- '{{BaseURL}}/wp-config.php'
- '{{BaseURL}}/wp-config-sample.php'
- '{{BaseURL}}/wp-config.php.txt'
- '{{BaseURL}}/wp-config.php.bak'
- '{{BaseURL}}/wp-config.php.old'
- '{{BaseURL}}/wp-config-backup.txt'
- '{{BaseURL}}/wp-config.php.save'
- '{{BaseURL}}/wp-config.php~'
- '{{BaseURL}}/wp-config.php.orig'
- '{{BaseURL}}/wp-config.php.original'
- '{{BaseURL}}/wp-license.php?file=../..//wp-config'
- '{{BaseURL}}/_wpeprivate/config.json'
matchers:
- type: word
words:
- DB_NAME
- WPENGINE_ACCOUNT
part: body