mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
f6f9a2bbf7
modules/recon/spring-application-config-exposure.yaml flags an exposed Spring application config, in either properties or yaml form, on a datasource marker paired with a credential field, then extracts the jdbc url. requiring the credential keeps a config that holds no secret from being reported. modules/recon/appsettings-exposure.yaml flags an exposed ASP.NET Core appsettings.json, the .NET Core counterpart to web.config, on a ConnectionStrings section paired with an inline password, then extracts the connection string. modules/recon/wp-config-backup-exposure.yaml flags an exposed wp-config backup, the leftover .bak or swap copy that serves raw php, on the DB_PASSWORD constant paired with another db define, then extracts the database password. internal/modules/app_config_exposure_test.go drives the three modules end to end through ExecuteHTTPModule and asserts the leak alongside the near misses a strict review wants pinned: a config with no credential, a password outside a connection strings section, a passwordless connection string, prose that names DB_PASSWORD, a config shown in an html page, a plain 200 body and a 404, none of which may match. verify: go test ./internal/modules, each matcher, marker, guard and extractor proven to bite (break -> red, restore -> green).
61 lines
1.2 KiB
YAML
61 lines
1.2 KiB
YAML
# WordPress Config Backup Exposure Detection Module
|
|
|
|
id: wp-config-backup-exposure
|
|
info:
|
|
name: WordPress Config Backup Exposure
|
|
author: sif
|
|
severity: high
|
|
description: Detects an exposed wp-config backup that leaks the WordPress database credentials
|
|
tags: [wordpress, php, wp-config, database, exposure, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/wp-config.php.bak"
|
|
- "{{BaseURL}}/wp-config.php~"
|
|
- "{{BaseURL}}/wp-config.php.save"
|
|
- "{{BaseURL}}/wp-config.php.orig"
|
|
- "{{BaseURL}}/wp-config.php.old"
|
|
- "{{BaseURL}}/wp-config.php.txt"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "DB_PASSWORD"
|
|
|
|
- type: word
|
|
part: body
|
|
condition: or
|
|
words:
|
|
- "DB_NAME"
|
|
- "DB_USER"
|
|
- "DB_HOST"
|
|
- "define("
|
|
|
|
- type: word
|
|
part: body
|
|
negative: true
|
|
condition: or
|
|
words:
|
|
- "<!DOCTYPE"
|
|
- "<!doctype"
|
|
- "<html"
|
|
- "<HTML"
|
|
- "<head>"
|
|
- "<title>"
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: db_password
|
|
part: body
|
|
regex:
|
|
- "DB_PASSWORD'\\s*,\\s*'([^']+)'"
|
|
group: 1
|