feat(modules): add loki, jaeger and zipkin exposure modules (#248)

add recon modules for unauthenticated observability backends that leak service topology and log data: loki serves its log query api when auth_enabled is false (401 otherwise), and jaeger and zipkin ship no authentication so a reachable instance exposes the service map and trace data.

modules/recon/jaeger-query-exposure.yaml

@@ -0,0 +1,43 @@
+# Jaeger Query Service Exposure Detection Module
+
+id: jaeger-query-exposure
+info:
+  name: Jaeger Query Service Exposure
+  author: sif
+  severity: medium
+  description: Detects an exposed Jaeger query service that leaks the internal service topology and trace data over its unauthenticated api
+  tags: [jaeger, tracing, distributed-tracing, observability, topology, exposure, unauth, api, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/api/services"
+
+  matchers:
+    - type: regex
+      part: body
+      regex:
+        - '"data"\s*:\s*\['
+
+    - type: word
+      part: body
+      words:
+        - "\"total\""
+        - "\"limit\""
+        - "\"offset\""
+        - "\"errors\""
+      condition: and
+
+    - type: status
+      status:
+        - 200
+
+  extractors:
+    - type: regex
+      name: jaeger_service
+      part: body
+      regex:
+        - '"data"\s*:\s*\[\s*"([^"]+)"'
+      group: 1

modules/recon/loki-api-exposure.yaml

@@ -0,0 +1,39 @@
+# Grafana Loki Log API Exposure Detection Module
+
+id: loki-api-exposure
+info:
+  name: Grafana Loki Log API Exposure
+  author: sif
+  severity: high
+  description: Detects a Grafana Loki deployment with auth_enabled disabled that serves log labels and content to anyone over its query api
+  tags: [loki, grafana, logs, log-aggregation, observability, exposure, unauth, api, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/loki/api/v1/labels"
+
+  matchers:
+    - type: regex
+      part: body
+      regex:
+        - '"status"\s*:\s*"success"'
+
+    - type: word
+      part: body
+      words:
+        - "\"data\""
+
+    - type: status
+      status:
+        - 200
+
+  extractors:
+    - type: regex
+      name: loki_label
+      part: body
+      regex:
+        - '"data"\s*:\s*\[\s*"([^"]+)"'
+      group: 1

modules/recon/zipkin-exposure.yaml

@@ -0,0 +1,37 @@
+# Zipkin Tracing Server Exposure Detection Module
+
+id: zipkin-exposure
+info:
+  name: Zipkin Tracing Server Exposure
+  author: sif
+  severity: medium
+  description: Detects an exposed Zipkin server that leaks the internal service topology and trace data over its unauthenticated api
+  tags: [zipkin, tracing, distributed-tracing, observability, topology, exposure, unauth, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/zipkin/config.json"
+
+  matchers:
+    - type: word
+      part: body
+      words:
+        - "\"queryLimit\""
+        - "\"defaultLookback\""
+        - "\"searchEnabled\""
+      condition: and
+
+    - type: status
+      status:
+        - 200
+
+  extractors:
+    - type: regex
+      name: zipkin_environment
+      part: body
+      regex:
+        - '"environment"\s*:\s*"([^"]*)"'
+      group: 1