gossan-hidden 0.3.0

Hidden endpoint and misconfiguration scanner for gossan (CORS, SSRF, JWT, Swagger, cache deception) — part of the security research ecosystem
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

# Debug and monitoring endpoint exposure probes.
# Loaded at compile time to eliminate hardcoded constants.

[[probe]]
path = "/actuator"
name = "Spring Boot Actuator Index"
framework = "Spring Boot"
severity = "High"
confirm_strings = ["_links", "actuator"]

[[probe]]
path = "/actuator/env"
name = "Spring Boot Environment Variables"
framework = "Spring Boot"
severity = "Critical"
confirm_strings = ["propertySources", "systemProperties"]

[[probe]]
path = "/actuator/heapdump"
name = "Spring Boot Heap Dump"
framework = "Spring Boot"
severity = "Critical"
confirm_strings = []

[[probe]]
path = "/actuator/configprops"
name = "Spring Boot Config Properties"
framework = "Spring Boot"
severity = "High"
confirm_strings = ["beans", "prefix"]

[[probe]]
path = "/actuator/mappings"
name = "Spring Boot Request Mappings"
framework = "Spring Boot"
severity = "Medium"
confirm_strings = ["dispatcherServlets", "requestMappingConditions"]

[[probe]]
path = "/__debug__/"
name = "Django Debug Toolbar"
framework = "Django"
severity = "Critical"
confirm_strings = ["djDebug", "debug toolbar"]

[[probe]]
path = "/debug/pprof/"
name = "Go pprof Profiler"
framework = "Go net/http/pprof"
severity = "High"
confirm_strings = ["goroutine", "heap", "profile"]

[[probe]]
path = "/metrics"
name = "Prometheus Metrics Endpoint"
framework = "Prometheus"
severity = "Medium"
confirm_strings = ["# HELP", "# TYPE", "process_"]

[[probe]]
path = "/healthz"
name = "Kubernetes Health Check"
framework = "Kubernetes"
severity = "Info"
confirm_strings = []

[[probe]]
path = "/server-status"
name = "Apache Server Status"
framework = "Apache httpd"
severity = "Medium"
confirm_strings = ["Apache Server Status", "Total Accesses"]

[[probe]]
path = "/server-info"
name = "Apache Server Info"
framework = "Apache httpd"
severity = "High"
confirm_strings = ["Server Settings", "Module Name"]

[[probe]]
path = "/_profiler/"
name = "Symfony Web Profiler"
framework = "Symfony"
severity = "High"
confirm_strings = ["sf-toolbar", "profiler"]

[[probe]]
path = "/elmah.axd"
name = "ELMAH Error Log"
framework = "ASP.NET ELMAH"
severity = "High"
confirm_strings = ["Error Log for", "ELMAH"]

[[probe]]
path = "/trace.axd"
name = "ASP.NET Trace"
framework = "ASP.NET"
severity = "High"
confirm_strings = ["Application Trace", "Request Details"]

[[probe]]
path = "/info.php"
name = "PHP Info Page"
framework = "PHP"
severity = "Medium"
confirm_strings = ["phpinfo()", "PHP Version"]

[[probe]]
path = "/graphiql"
name = "GraphiQL IDE Exposed"
framework = "GraphQL"
severity = "Medium"
confirm_strings = ["graphiql", "GraphiQL"]

[[probe]]
path = "/__webpack_hmr"
name = "Webpack HMR Endpoint"
framework = "Webpack Dev Server"
severity = "Medium"
confirm_strings = []