feat(modules): add node inspector, rails routes and openapi exposure modules (#293)

modules/recon/node-inspector-exposure.yaml

@@ -0,0 +1,47 @@
+# Node.js V8 Inspector Exposure Detection Module
+
+id: node-inspector-exposure
+info:
+  name: Node.js V8 Inspector Exposure
+  author: sif
+  severity: high
+  description: Detects an open node.js v8 inspector whose websocket debugger allows arbitrary code execution in the process
+  tags: [node, inspector, debugger, rce, exposure, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/json"
+    - "{{BaseURL}}/json/list"
+
+  matchers:
+    - type: status
+      status:
+        - 200
+
+    - type: regex
+      part: body
+      regex:
+        - '"webSocketDebuggerUrl"\s*:\s*"ws://'
+
+    - type: word
+      part: body
+      words:
+        - "\"devtoolsFrontendUrl\""
+
+  extractors:
+    - type: regex
+      name: ws_debugger_url
+      part: body
+      regex:
+        - '"webSocketDebuggerUrl"\s*:\s*"(ws://[^"]+)"'
+      group: 1
+
+    - type: regex
+      name: inspector_title
+      part: body
+      regex:
+        - '"title"\s*:\s*"([^"]+)"'
+      group: 1

modules/recon/openapi-spec-exposure.yaml

@@ -0,0 +1,53 @@
+# OpenAPI/Swagger Specification Exposure Detection Module
+
+id: openapi-spec-exposure
+info:
+  name: OpenAPI/Swagger Specification Exposure
+  author: sif
+  severity: low
+  description: Detects a publicly readable openapi/swagger specification that discloses the full api surface
+  tags: [openapi, swagger, api, exposure, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/openapi.json"
+    - "{{BaseURL}}/v3/api-docs"
+    - "{{BaseURL}}/v2/api-docs"
+    - "{{BaseURL}}/swagger.json"
+    - "{{BaseURL}}/api-docs"
+
+  matchers:
+    - type: status
+      status:
+        - 200
+
+    - type: regex
+      part: body
+      condition: or
+      regex:
+        - '"openapi"\s*:\s*"3(\.[0-9]+)+"'
+        - '"swagger"\s*:\s*"2(\.[0-9]+)+"'
+
+    - type: word
+      part: body
+      words:
+        - "\"paths\""
+
+  extractors:
+    - type: regex
+      name: api_title
+      part: body
+      regex:
+        - '"title"\s*:\s*"([^"]+)"'
+      group: 1
+
+    - type: regex
+      name: api_version
+      part: body
+      regex:
+        - '"openapi"\s*:\s*"([0-9.]+)"'
+        - '"swagger"\s*:\s*"([0-9.]+)"'
+      group: 1

modules/recon/rails-routes-exposure.yaml

@@ -0,0 +1,31 @@
+# Rails Routes Info Page Exposure Detection Module
+
+id: rails-routes-exposure
+info:
+  name: Rails Routes Info Page Exposure
+  author: sif
+  severity: medium
+  description: Detects an exposed rails /rails/info/routes page that only renders in development mode and leaks the full route map
+  tags: [rails, ruby, debug, routes, exposure, misconfiguration, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/rails/info/routes"
+
+  matchers:
+    - type: status
+      status:
+        - 200
+
+    - type: word
+      part: body
+      words:
+        - "Controller#Action"
+
+    - type: word
+      part: body
+      words:
+        - "HTTP Verb"