30 lines
815 B
YAML
30 lines
815 B
YAML
id: dwr-index-detect
|
|
|
|
info:
|
|
name: DWR detect test page detection
|
|
author: pussycat0x
|
|
severity: low
|
|
description: The index contains the list of exposed Java classes. From here one can navigate to the test page of each class where every callable method is described and can be easily tested. This is a great way
|
|
to find out what methods are exposed and learn how they function.
|
|
reference:
|
|
- http://aetherlab.net/2012/09/experiences-in-pentesting-dwr/
|
|
metadata:
|
|
google-dork: intitle:"DWR Test Index"
|
|
tags: tech,misconfig,dwr
|
|
|
|
requests:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/dwr/index.html'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "<title>DWR Test Index</title>"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|