mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
8c732f9955
an exposed /metrics endpoint leaks process, runtime and request internals that aid recon. match the prometheus text exposition format structurally (a # HELP line plus a # TYPE line ending in one of the known metric types) so a json /metrics or prose that mentions the format does not trip it. extract the go runtime version from go_info when it is present.
39 lines
840 B
YAML
39 lines
840 B
YAML
# Prometheus Metrics Exposure Detection Module
|
|
|
|
id: prometheus-metrics-exposure
|
|
info:
|
|
name: Prometheus Metrics Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects an exposed Prometheus metrics endpoint leaking internals
|
|
tags: [prometheus, metrics, exposure, misconfiguration, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/metrics"
|
|
- "{{BaseURL}}/actuator/prometheus"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: regex
|
|
part: body
|
|
condition: and
|
|
regex:
|
|
- '(?m)^# HELP \S+ '
|
|
- '(?m)^# TYPE \S+ (counter|gauge|histogram|summary|untyped)'
|
|
- '(?m)^[a-zA-Z_][a-zA-Z0-9_:]*(\{[^}]*\})? -?[0-9]'
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: go_version
|
|
part: body
|
|
regex:
|
|
- 'go_info\{version="([^"]+)"'
|
|
group: 1
|