mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
TigahandGitHub
3ed9ea4b6f
modules/recon/kong-api-exposure.yaml flags an exposed Kong admin api that grants full control of the gateway, keyed on the available plugins map paired with the admin listen address that the node reports, then extracts the kong version. modules/recon/jolokia-api-exposure.yaml flags an exposed Jolokia agent that bridges http to jmx, keyed on the agent and protocol fields of its version response, then extracts the agent version. modules/recon/nats-api-exposure.yaml flags an exposed NATS monitoring endpoint that leaks the server topology, keyed on the server id paired with the max payload, then extracts the server version. internal/modules/management_api_exposure_test.go drives the three modules end to end through ExecuteHTTPModule and asserts the leak alongside the near misses a strict review wants pinned: each service with one keying field missing, a generic version response, a plain 200 and a 404. verify: go test ./internal/modules, each matcher and extractor proven to bite (break -> red, restore -> green).
43 lines
835 B
YAML
43 lines
835 B
YAML
# Jolokia API Exposure Detection Module
|
|
|
|
id: jolokia-api-exposure
|
|
info:
|
|
name: Jolokia API Exposure
|
|
author: sif
|
|
severity: high
|
|
description: Detects an exposed Jolokia agent that bridges http to jmx for remote management
|
|
tags: [jolokia, jmx, java, api, exposure, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/jolokia/version"
|
|
- "{{BaseURL}}/actuator/jolokia/version"
|
|
- "{{BaseURL}}/api/jolokia/version"
|
|
- "{{BaseURL}}/hawtio/jolokia/version"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"agent\""
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"protocol\""
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: jolokia_agent_version
|
|
part: body
|
|
regex:
|
|
- '"agent"\s*:\s*"([^"]+)"'
|
|
group: 1
|