90 lines
4.1 KiB
YAML
90 lines
4.1 KiB
YAML
id: graylog-api-exposure
|
|
|
|
info:
|
|
name: Graylog REST API Endpoints - Exposure
|
|
author: Arqsz
|
|
severity: info
|
|
description: |
|
|
Graylog is a centralized log management solution. According to the official documentation, it exposes multiple endpoints (some by default).
|
|
reference:
|
|
- https://go2docs.graylog.org/5-0/setting_up_graylog/rest_api.html
|
|
- https://gist.github.com/asachs01/f1f317b2924a688deb8ed2520a4520bd
|
|
metadata:
|
|
max-request: 50
|
|
shodan-query: Graylog
|
|
verified: true
|
|
tags: tech,graylog,api,swagger,fuzz
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
- "{{BaseURL}}/api/api-docs"
|
|
- "{{BaseURL}}/api/api-browser"
|
|
- "{{BaseURL}}/api/cluster"
|
|
- "{{BaseURL}}/api/dashboards"
|
|
- "{{BaseURL}}/api/events/definitions"
|
|
- "{{BaseURL}}/api/events/definitions/validate"
|
|
- "{{BaseURL}}/api/events/notifications/test"
|
|
- "{{BaseURL}}/api/events/search"
|
|
- "{{BaseURL}}/api/free-enterprise/license"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.enterprise.integrations/office365/checkSubscriptions"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.enterprise.integrations/office365/inputs"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.enterprise.integrations/office365/startSubscription"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.integrations/aws/cloudwatch/log_groups"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.integrations/aws/inputs"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.integrations/aws/kinesis/auto_setup/create_stream"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.integrations/aws/kinesis/auto_setup/create_subscription"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.integrations/aws/kinesis/auto_setup/create_subscription_policy"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.integrations/aws/kinesis/health_check"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.integrations/aws/kinesis/streams"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.plugins.archive/archives/catalog/rebuild"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.plugins.archive/backends"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.plugins.archive/cluster/archives/catalog/rebuild"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.plugins.collector/configurations"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.plugins.license/licenses/verify"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.plugins.report/reports"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.plugins.security/team-sync/test/backend"
|
|
- "{{BaseURL}}/api/plugins/org.graylog.plugins.security/teams"
|
|
- "{{BaseURL}}/api/scheduler/jobs"
|
|
- "{{BaseURL}}/api/system/authentication/services/backends"
|
|
- "{{BaseURL}}/api/system/authentication/services/test/backend/connection"
|
|
- "{{BaseURL}}/api/system/authentication/services/test/backend/login"
|
|
- "{{BaseURL}}/api/system"
|
|
- "{{BaseURL}}/api/system/content_packs"
|
|
- "{{BaseURL}}/api/system/indexer/cluster/health"
|
|
- "{{BaseURL}}/api/system/indexer/cluster/name"
|
|
- "{{BaseURL}}/api/system/debug/events/cluster"
|
|
- "{{BaseURL}}/api/system/debug/events/local"
|
|
- "{{BaseURL}}/api/system/jobs"
|
|
- "{{BaseURL}}/api/system/pipelines/pipeline"
|
|
- "{{BaseURL}}/api/system/pipelines/rule"
|
|
- "{{BaseURL}}/api/system/urlwhitelist/check"
|
|
- "{{BaseURL}}/api/system/urlwhitelist/generate_regex"
|
|
- "{{BaseURL}}/api/views"
|
|
- "{{BaseURL}}/api/views/fields"
|
|
- "{{BaseURL}}/api/views/forValue"
|
|
- "{{BaseURL}}/api/views/search/messages"
|
|
- "{{BaseURL}}/api/views/search/metadata"
|
|
- "{{BaseURL}}/api/views/search/sync"
|
|
- "{{BaseURL}}/api/users"
|
|
|
|
host-redirects: true
|
|
stop-at-first-match: true
|
|
matchers-condition: or
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "status_code == 200"
|
|
- "contains_any(header, 'X-Graylog-Node-Id', 'Graylog', 'graylog')"
|
|
- "contains_any(body, 'X-Graylog-Node-Id', 'Graylog', 'graylog')"
|
|
- "contains_any(body, 'swagger')"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: unauthorized-graylog-header
|
|
dsl:
|
|
- "status_code == 401"
|
|
- "contains(header, 'X-Graylog-Node-Id') || contains(header, 'Graylog Server')"
|
|
condition: and
|