mirror of
https://github.com/lunchcat/sif.git
synced 2026-08-01 16:27:37 -07:00
TigahandGitHub
243e0aba16
* feat(modules): add haproxy stats, nexus and pushgateway exposure modules * chore(modules): trim redundant module header comments drop the top-line comments on the new infra exposure modules that just restated the id/name fields already in the info block
40 lines
940 B
YAML
40 lines
940 B
YAML
id: pushgateway-exposure
|
|
info:
|
|
name: Prometheus Pushgateway Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects a Prometheus Pushgateway reachable without authentication, which by design accepts arbitrary metric pushes and deletes from anyone who can reach it and can serve whatever business or infra metrics other jobs have already pushed
|
|
tags: [pushgateway, prometheus, monitoring, metrics, api, exposure, unauth, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/api/v1/status"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"build_information\""
|
|
- "\"start_time\""
|
|
condition: and
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '"status"\s*:\s*"success"'
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: pushgateway_version
|
|
part: body
|
|
regex:
|
|
- '"version"\s*:\s*"([^"]+)"'
|
|
group: 1
|