nuclei-templates/http/exposures/configs/mercurial-hgignore.yaml

52 lines
1.4 KiB
YAML

id: mercurial-hgignore
info:
name: Mercurial Ignore - File Disclosure
author: DhiyaneshDK
severity: info
description: Mercurial Ignore file disclosure was detected.
reference:
- https://swcarpentry.github.io/hg-novice/08-ignore/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0
cwe-id: CWE-200
cpe: cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
shodan-query: html:"hgignore"
product: mercurial
vendor: mercurial
tags: exposure,hgignore,config,mercurial
http:
- method: GET
path:
- "{{BaseURL}}/.hgignore"
matchers-condition: and
matchers:
- type: dsl
dsl:
- 'len(body) > 50'
- 'status_code == 200'
condition: and
- type: word
words:
- "MongoDB over HTTP on the native"
- "application/javascript"
- "application/x-javascript"
- "application/json"
- "application/xml"
- "html"
- "<!doctype"
- "<script"
- "<meta"
- "image/"
- "Response xmlns="
part: response
negative: true
condition: or
# digest: 4b0a00483046022100cea70abf7de6f5fd651d34717ae28825b7b33f8875f2127fa319b672ba4aee4f022100b1be671879cc8a7e08cb76ed302a123e5c97f8f87526f0ec7fa38c4161153b7f:922c64590222798bb761d5b6d8e72950