Tigah 27a8a27880 feat(modules): add werkzeug debugger exposure module (#149) ...

a flask app left on debug=True wraps the wsgi app in werkzeug's
DebuggedApplication, which serves its debugger assets unauthenticated:
GET /?__debugger__=yes&cmd=resource&f=debugger.js returns the debugger
javascript with no pin and no live exception required. that exposes the
interactive console (an rce vector) and tracebacks that leak source and
config.

probe that asset path and match two javascript anchors stable across
werkzeug 0.14 through 3.0 so a page that only references the debugger
does not match, then read the werkzeug version from the server header.

2026-06-22 17:58:22 -07:00

..

http

feat(modules): add graphql introspection detection module (#139)

2026-06-22 17:53:28 -07:00

info

feat(modules): add portainer, traefik, keycloak and rabbitmq panel modules (#190)

2026-06-22 17:26:16 -07:00

recon

feat(modules): add werkzeug debugger exposure module (#149)

2026-06-22 17:58:22 -07:00