mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
TigahandGitHub
1f3708531d
Detect unauthenticated web database browsers, which ship with no default auth and hand over a full data browser once reachable. Each keys on an app-specific anchor (the ME_SETTINGS global, the redisCommander.js script, ace-pgsql.js) under an and-condition so a branded soft-404 cannot trip it. mongo-express also requires the database-list heading, since its login form renders the same settings global, title and logo but serves no data.
43 lines
1017 B
YAML
43 lines
1017 B
YAML
# Mongo Express Panel Detection Module
|
|
|
|
id: mongo-express-panel
|
|
info:
|
|
name: Mongo Express Panel
|
|
author: sif
|
|
severity: high
|
|
description: Detects an exposed Mongo Express MongoDB admin panel serving its database list without authentication
|
|
tags: [mongo-express, mongodb, database, panel, exposure, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "globalThis.ME_SETTINGS"
|
|
|
|
# the ME_SETTINGS global and the title/logo also render on the unauth
|
|
# connection form, so require the database-list heading too: it is served
|
|
# only once a live listing is rendered, which is the exposure this flags.
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- ">Databases</h4>"
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: mongodb_version
|
|
part: body
|
|
regex:
|
|
- '<strong>MongoDB Version</strong></td>\s*<td>([0-9]+\.[0-9]+(?:\.[0-9]+)?)'
|
|
group: 1
|