# Htaccess Exposure Detection Module id: htaccess-exposure info: name: Htaccess Exposure author: sif severity: medium description: Detects an exposed htaccess file that leaks rewrite rules and access control config tags: [apache, htaccess, config, info-disclosure, exposure, recon] type: http http: method: GET paths: - "{{BaseURL}}/.htaccess" matchers: - type: status status: - 200 - type: word part: body condition: or words: - "RewriteEngine" - "RewriteRule" - "RewriteCond" - "AuthUserFile" - "AuthType" - "" - "" extractors: - type: regex name: auth_user_file part: body regex: - 'AuthUserFile\s+(\S+)' group: 1