From b293beb33209ee360beeeb050f2a351b81baad7e Mon Sep 17 00:00:00 2001 From: Kristian Bremberg Date: Fri, 4 Jun 2021 13:26:51 +0200 Subject: [PATCH] Additional modules --- .../apache-ambari-default-credentials.json | 20 +++++++++++++++++++ modules/exposed-docker-socket.json | 19 ++++++++++++++++++ modules/exposed-jquery-file-upload.json | 12 +++++++++++ modules/exposed-nginx-status.json | 11 ++++++++++ modules/http-response-splitting.json | 11 ++++++++++ modules/open-redirect-1.json | 13 ++++++++++++ modules/spring-boot-env-route.json | 16 +++++++++++++++ 7 files changed, 102 insertions(+) create mode 100644 modules/apache-ambari-default-credentials.json create mode 100644 modules/exposed-docker-socket.json create mode 100644 modules/exposed-jquery-file-upload.json create mode 100644 modules/exposed-nginx-status.json create mode 100644 modules/http-response-splitting.json create mode 100644 modules/open-redirect-1.json create mode 100644 modules/spring-boot-env-route.json diff --git a/modules/apache-ambari-default-credentials.json b/modules/apache-ambari-default-credentials.json new file mode 100644 index 0000000..a86a2e2 --- /dev/null +++ b/modules/apache-ambari-default-credentials.json @@ -0,0 +1,20 @@ +{ + "request": { + "path": "/api/v1/users/admin?fields=*,privileges/PrivilegeInfo/cluster_name,privileges/PrivilegeInfo/permission_name", + "headers": [ + "Authorization: Basic YWRtaW46YWRtaW4=" + ] + }, + "response": { + "matchesRequired": 5, + "matches": [ + {"type": "status", "code": 200, "required": true}, + {"type": "static", "pattern": "active"}, + {"type": "static", "pattern": "admin"}, + {"type": "static", "pattern": "groups"}, + {"type": "static", "pattern": "ldap_user"}, + {"type": "static", "pattern": "user_name"}, + {"type": "static", "pattern": "user_type"} + ] + } +} \ No newline at end of file diff --git a/modules/exposed-docker-socket.json b/modules/exposed-docker-socket.json new file mode 100644 index 0000000..ecf5cc4 --- /dev/null +++ b/modules/exposed-docker-socket.json @@ -0,0 +1,19 @@ +{ + "request": { + "path": "containers/json" + }, + "response": { + "matchesRequired": 5, + "matches": [ + {"type": "status", "code": 200, "required": true}, + {"type": "header", "name": "Content-Type", "pattern": "(?i)application/json", "required": true}, + {"type": "static", "pattern": "\"Id\"", "required": true}, + {"type": "static", "pattern": "\"Names\""}, + {"type": "static", "pattern": "\"Image\""}, + {"type": "static", "pattern": "\"ImageID\""}, + {"type": "static", "pattern": "\"Command\""}, + {"type": "static", "pattern": "\"Created\""}, + {"type": "static", "pattern": "\"State\""} + ] + } +} \ No newline at end of file diff --git a/modules/exposed-jquery-file-upload.json b/modules/exposed-jquery-file-upload.json new file mode 100644 index 0000000..371368d --- /dev/null +++ b/modules/exposed-jquery-file-upload.json @@ -0,0 +1,12 @@ +{ + "request": { + "path": "jquery-file-upload/server/php/" + }, + "response": { + "matchesRequired": 2, + "matches": [ + {"type": "status", "code": 200, "required": true}, + {"type": "regex", "pattern": "^{\"files\":"} + ] + } +} \ No newline at end of file diff --git a/modules/exposed-nginx-status.json b/modules/exposed-nginx-status.json new file mode 100644 index 0000000..d09e982 --- /dev/null +++ b/modules/exposed-nginx-status.json @@ -0,0 +1,11 @@ +{ + "request": { + "path": "/nginx_status" + }, + "response": { + "matchesRequired": 1, + "matches": [ + {"type": "static", "pattern": "server accepts handled requests"} + ] + } +} \ No newline at end of file diff --git a/modules/http-response-splitting.json b/modules/http-response-splitting.json new file mode 100644 index 0000000..9f6f460 --- /dev/null +++ b/modules/http-response-splitting.json @@ -0,0 +1,11 @@ +{ + "request": { + "path": "/%0d%0ahrs:hrs" + }, + "response": { + "matchesRequired": 1, + "matches": [ + {"type": "header", "name": "hrs", "pattern": "."} + ] + } +} \ No newline at end of file diff --git a/modules/open-redirect-1.json b/modules/open-redirect-1.json new file mode 100644 index 0000000..0bfee30 --- /dev/null +++ b/modules/open-redirect-1.json @@ -0,0 +1,13 @@ +{ + "request": { + "path": "//example.com" + }, + "response": { + "matchesRequired": 2, + "matches": [ + {"type": "status", "code": 301}, + {"type": "status", "code": 302}, + {"type": "header", "name": "Location", "pattern": "(?i)^//example.om"} + ] + } +} \ No newline at end of file diff --git a/modules/spring-boot-env-route.json b/modules/spring-boot-env-route.json new file mode 100644 index 0000000..2b0e550 --- /dev/null +++ b/modules/spring-boot-env-route.json @@ -0,0 +1,16 @@ +{ + "request": { + "path": "/actuator/env" + }, + "response": { + "matchesRequired": 6, + "matches": [ + {"type": "status", "code": 200, "required": true}, + {"type": "header", "name": "Content-Type", "pattern": "(?i)application/json", "required": true}, + {"type": "static", "pattern": "\"profiles"}, + {"type": "static", "pattern": "\"servletContextInitParams"}, + {"type": "static", "pattern": "\"systemProperties"}, + {"type": "static", "pattern": "\"systemEnvironment"} + ] + } +} \ No newline at end of file