mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-03 03:14:53 -07:00
1bbc564170
an elasticsearch node left without authentication answers its root banner to any client, and versions before 8.0 ship with no auth by default, so a 200 at / means every index is readable without credentials. match the "You Know, for Search" tagline together with the lucene_version field so a page that only quotes the tagline in prose does not match, then read the cluster version from the version.number field.