nuclei-templates/http/exposures/configs/mercurial-hgignore.yaml

53 lines
1.4 KiB
YAML

id: mercurial-hgignore
info:
name: Mercurial Ignore - File Disclosure
author: DhiyaneshDK
severity: info
description: Mercurial Ignore file disclosure was detected.
reference:
- https://swcarpentry.github.io/hg-novice/08-ignore/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0
cwe-id: CWE-200
cpe: cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
shodan-query: html:"hgignore"
product: mercurial
vendor: mercurial
tags: exposure,hgignore,config,mercurial
http:
- method: GET
path:
- "{{BaseURL}}/.hgignore"
matchers-condition: and
matchers:
- type: dsl
dsl:
- 'len(body) > 50'
- 'status_code == 200'
condition: and
- type: word
words:
- "MongoDB over HTTP on the native"
- "application/javascript"
- "application/x-javascript"
- "application/json"
- "application/xml"
- "html"
- "<!doctype"
- "<script"
- "<meta"
- "image/"
- "Response xmlns="
part: response
negative: true
condition: or
# digest: 490a0046304402206734ac004b2ada4fb5ae55af64ea6cbcda2c8305324e611fdf4808d9a16cde3202204ea9312820a5729f4511297d6dbb0d5cb0e4c7bff4496f02075169e2f65bb2b9:922c64590222798bb761d5b6d8e72950