gossan-hidden 0.3.3

# Hidden scanner check definitions (data-driven configuration).
#
# Users can add new checks by adding entries to this file or creating
# additional TOML files in the same directory. No Rust recompilation needed.
#
# Fields:
#   path: URL path to probe
#   title: Finding title
#   severity: One of: Critical, High, Medium, Low, Info
#   detail: Detailed description
#   tag: Category tag
#   content_probe: Optional string to validate response content (null if none)

# ── Source control ────────────────────────────────────────────────────────────

[[checks]]
path = "/.git/HEAD"
title = "Git repository exposed"
severity = "Critical"
detail = "The .git directory is publicly accessible (full source reconstruction possible)."
tag = "git"
content_probe = "ref:"

[[checks]]
path = "/.git/config"
title = "Git config exposed"
severity = "Critical"
detail = ".git/config leaked (remote URLs, credentials, branch names)."
tag = "git"
content_probe = "[core]"

[[checks]]
path = "/.git/COMMIT_EDITMSG"
title = "Git commit message exposed"
severity = "High"
detail = ".git/COMMIT_EDITMSG readable (recent commit messages visible)."
tag = "git"
content_probe = " "

[[checks]]
path = "/.git/logs/HEAD"
title = "Git reflog exposed"
severity = "High"
detail = ".git/logs/HEAD readable (full commit history visible)."
tag = "git"
content_probe = "commit"

[[checks]]
path = "/.svn/entries"
title = "SVN repository exposed"
severity = "Critical"
detail = ".svn/entries readable: Subversion repository layout disclosed."
tag = "git"
content_probe = "dir"

[[checks]]
path = "/.hg/hgrc"
title = "Mercurial repository exposed"
severity = "Critical"
detail = ".hg/hgrc readable: Mercurial repository config disclosed."
tag = "git"
content_probe = "["

[[checks]]
path = "/.bzr/branch/format"
title = "Bazaar repository exposed"
severity = "High"
detail = ".bzr repository metadata accessible."
tag = "git"
content_probe = "Bazaar"

# ── SSH / crypto keys ────────────────────────────────────────────────────────

[[checks]]
path = "/.ssh/id_rsa"
title = "SSH private key exposed"
severity = "Critical"
detail = "SSH RSA private key publicly accessible (full server compromise)."
tag = "keys"
content_probe = "PRIVATE KEY"

[[checks]]
path = "/.ssh/id_ed25519"
title = "SSH private key exposed"
severity = "Critical"
detail = "SSH Ed25519 private key publicly accessible."
tag = "keys"
content_probe = "PRIVATE KEY"

[[checks]]
path = "/.ssh/id_ecdsa"
title = "SSH private key exposed"
severity = "Critical"
detail = "SSH ECDSA private key publicly accessible."
tag = "keys"
content_probe = "PRIVATE KEY"

[[checks]]
path = "/id_rsa"
title = "SSH private key exposed"
severity = "Critical"
detail = "SSH private key at root (full server compromise)."
tag = "keys"
content_probe = "PRIVATE KEY"

[[checks]]
path = "/.git-credentials"
title = "Git credentials exposed"
severity = "Critical"
detail = ".git-credentials contains stored username:password for git remotes."
tag = "keys"
content_probe = "http"

[[checks]]
path = "/.npmrc"
title = "npm auth token exposed"
severity = "High"
detail = ".npmrc contains npm registry auth token (allows package publishing)."
tag = "keys"
content_probe = "_authToken"

[[checks]]
path = "/.pypirc"
title = "PyPI credentials exposed"
severity = "High"
detail = ".pypirc contains PyPI credentials (allows package publishing)."
tag = "keys"
content_probe = "[distutils]"

[[checks]]
path = "/.bash_history"
title = "Shell history exposed"
severity = "High"
detail = ".bash_history accessible (contains executed commands, may reveal secrets)."
tag = "keys"

# ── Cloud credentials ────────────────────────────────────────────────────────

[[checks]]
path = "/.aws/credentials"
title = "AWS credentials exposed"
severity = "Critical"
detail = ".aws/credentials accessible: AWS access key and secret readable."
tag = "cloud"
content_probe = "aws_access_key_id"

[[checks]]
path = "/.aws/config"
title = "AWS config exposed"
severity = "High"
detail = ".aws/config accessible (reveals AWS region and role configuration)."
tag = "cloud"
content_probe = "[default]"

[[checks]]
path = "/.kube/config"
title = "Kubernetes config exposed"
severity = "Critical"
detail = ".kube/config accessible: Kubernetes cluster credentials leaked."
tag = "cloud"
content_probe = "apiVersion"

[[checks]]
path = "/.gcloud/application_default_credentials.json"
title = "GCP credentials exposed"
severity = "Critical"
detail = "GCP application default credentials accessible (cloud access token leaked)."
tag = "cloud"
content_probe = "client_id"

# ── Environment files ─────────────────────────────────────────────────────────

[[checks]]
path = "/.env"
title = ".env file exposed"
severity = "Critical"
detail = ".env publicly accessible (database creds, API keys, secrets)."
tag = "env"
content_probe = "="

[[checks]]
path = "/.env.local"
title = ".env.local exposed"
severity = "Critical"
detail = ".env.local exposed (local development secrets)."
tag = "env"
content_probe = "="

[[checks]]
path = "/.env.production"
title = "Production .env exposed"
severity = "Critical"
detail = ".env.production exposed (production credentials compromised)."
tag = "env"
content_probe = "="

[[checks]]
path = "/.env.staging"
title = "Staging .env exposed"
severity = "High"
detail = ".env.staging exposed (staging secrets readable)."
tag = "env"
content_probe = "="

[[checks]]
path = "/.env.backup"
title = ".env backup exposed"
severity = "High"
detail = "Backup .env file accessible."
tag = "env"
content_probe = "="

[[checks]]
path = "/.env.old"
title = ".env.old exposed"
severity = "High"
detail = "Old .env backup accessible."
tag = "env"
content_probe = "="

[[checks]]
path = "/.env.example"
title = ".env.example exposed"
severity = "Low"
detail = ".env.example reveals expected secret variable names."
tag = "env"
content_probe = "="

[[checks]]
path = "/src/.env"
title = "Source .env exposed"
severity = "Critical"
detail = "Source directory .env accessible."
tag = "env"
content_probe = "="

# ── Config files ──────────────────────────────────────────────────────────────

[[checks]]
path = "/config.php"
title = "PHP config exposed"
severity = "High"
detail = "config.php accessible (may contain database credentials)."
tag = "config"

[[checks]]
path = "/wp-config.php.bak"
title = "WordPress config backup exposed"
severity = "Critical"
detail = "wp-config.php backup exposed (database credentials compromised)."
tag = "config"
content_probe = "DB_"

[[checks]]
path = "/wp-config.php~"
title = "WordPress config backup exposed"
severity = "Critical"
detail = "wp-config.php~ backup exposed (database credentials compromised)."
tag = "config"
content_probe = "DB_"

[[checks]]
path = "/settings.py"
title = "Django settings exposed"
severity = "High"
detail = "settings.py accessible: SECRET_KEY and db credentials."
tag = "config"
content_probe = "SECRET_KEY"

[[checks]]
path = "/_config.yml"
title = "Jekyll config exposed"
severity = "Low"
detail = "_config.yml reveals site config, may contain API keys."
tag = "config"

[[checks]]
path = "/config.yml"
title = "Config YAML exposed"
severity = "Medium"
detail = "config.yml accessible (may contain application secrets)."
tag = "config"

[[checks]]
path = "/config.yaml"
title = "Config YAML exposed"
severity = "Medium"
detail = "config.yaml accessible."
tag = "config"

[[checks]]
path = "/.htpasswd"
title = ".htpasswd exposed"
severity = "High"
detail = "Password file exposed (hashed credentials readable)."
tag = "config"
content_probe = ":"

[[checks]]
path = "/web.config"
title = "web.config exposed"
severity = "High"
detail = "web.config accessible (connection strings and app config)."
tag = "config"
content_probe = "<"

# ── Package / dependency disclosure ──────────────────────────────────────────

[[checks]]
path = "/package.json"
title = "package.json exposed"
severity = "Low"
detail = "package.json readable (all npm deps and versions disclosed)."
tag = "disclosure"
content_probe = "dependencies"

[[checks]]
path = "/composer.json"
title = "composer.json exposed"
severity = "Low"
detail = "composer.json readable (all PHP deps disclosed)."
tag = "disclosure"
content_probe = "require"

[[checks]]
path = "/requirements.txt"
title = "requirements.txt exposed"
severity = "Low"
detail = "Python deps disclosed."
tag = "disclosure"

[[checks]]
path = "/Gemfile"
title = "Gemfile exposed"
severity = "Low"
detail = "Ruby deps disclosed."
tag = "disclosure"
content_probe = "gem"

[[checks]]
path = "/go.mod"
title = "go.mod exposed"
severity = "Low"
detail = "Go module deps disclosed."
tag = "disclosure"
content_probe = "module"

[[checks]]
path = "/Dockerfile"
title = "Dockerfile exposed"
severity = "Medium"
detail = "Container build process exposed (may reveal internal paths and secrets)."
tag = "disclosure"
content_probe = "FROM"

[[checks]]
path = "/docker-compose.yml"
title = "docker-compose.yml exposed"
severity = "Medium"
detail = "docker-compose.yml (service configs and ports disclosed)."
tag = "disclosure"
content_probe = "services"

[[checks]]
path = "/docker-compose.yaml"
title = "docker-compose.yaml exposed"
severity = "Medium"
detail = "docker-compose.yaml (service configs disclosed)."
tag = "disclosure"
content_probe = "services"

# ── Backup / dumps ────────────────────────────────────────────────────────────

[[checks]]
path = "/backup.zip"
title = "Backup archive exposed"
severity = "Critical"
detail = "backup.zip accessible (may contain full application source)."
tag = "backup"

[[checks]]
path = "/backup.tar.gz"
title = "Backup archive exposed"
severity = "Critical"
detail = "backup.tar.gz accessible (may contain full application source)."
tag = "backup"

[[checks]]
path = "/backup.tar"
title = "Backup archive exposed"
severity = "Critical"
detail = "backup.tar accessible."
tag = "backup"

[[checks]]
path = "/dump.sql"
title = "SQL dump exposed"
severity = "Critical"
detail = "dump.sql accessible (full database dump readable)."
tag = "backup"
content_probe = "INSERT INTO"

[[checks]]
path = "/db.sql"
title = "SQL dump exposed"
severity = "Critical"
detail = "db.sql accessible (full database dump)."
tag = "backup"
content_probe = "CREATE TABLE"

[[checks]]
path = "/database.sql"
title = "SQL dump exposed"
severity = "Critical"
detail = "database.sql accessible."
tag = "backup"
content_probe = "CREATE TABLE"

[[checks]]
path = "/backup.sql"
title = "SQL dump exposed"
severity = "Critical"
detail = "backup.sql accessible."
tag = "backup"
content_probe = "CREATE TABLE"

[[checks]]
path = "/data.sql"
title = "SQL dump exposed"
severity = "Critical"
detail = "data.sql accessible."
tag = "backup"
content_probe = "INSERT INTO"

# ── Spring Boot Actuator ──────────────────────────────────────────────────────

[[checks]]
path = "/actuator"
title = "Spring Boot Actuator exposed"
severity = "High"
detail = "/actuator exposed (application internals revealed)."
tag = "actuator"
content_probe = "_links"

[[checks]]
path = "/actuator/env"
title = "Spring Boot env actuator"
severity = "Critical"
detail = "/actuator/env exposed (env vars and config properties readable)."
tag = "actuator"
content_probe = "activeProfiles"

[[checks]]
path = "/actuator/health"
title = "Spring Boot health actuator"
severity = "Low"
detail = "/actuator/health exposed."
tag = "actuator"
content_probe = "status"

[[checks]]
path = "/actuator/info"
title = "Spring Boot info actuator"
severity = "Low"
detail = "/actuator/info exposed."
tag = "actuator"

[[checks]]
path = "/actuator/beans"
title = "Spring Boot beans actuator"
severity = "Medium"
detail = "/actuator/beans exposed: Spring bean list readable."
tag = "actuator"

[[checks]]
path = "/actuator/heapdump"
title = "Spring Boot heap dump exposed"
severity = "Critical"
detail = "/actuator/heapdump: JVM heap dump may contain plaintext secrets."
tag = "actuator"

[[checks]]
path = "/actuator/logfile"
title = "Spring Boot log file exposed"
severity = "High"
detail = "/actuator/logfile (application logs readable)."
tag = "actuator"

[[checks]]
path = "/actuator/metrics"
title = "Spring Boot metrics actuator"
severity = "Medium"
detail = "/actuator/metrics exposed."
tag = "actuator"

[[checks]]
path = "/actuator/threaddump"
title = "Spring Boot thread dump"
severity = "Medium"
detail = "/actuator/threaddump exposed."
tag = "actuator"

# ── Admin panels ──────────────────────────────────────────────────────────────

[[checks]]
path = "/admin"
title = "Admin panel exposed"
severity = "Medium"
detail = "/admin accessible (may expose admin interface)."
tag = "admin"

[[checks]]
path = "/administrator"
title = "Admin panel exposed"
severity = "Medium"
detail = "/administrator accessible."
tag = "admin"

[[checks]]
path = "/wp-admin/"
title = "WordPress admin exposed"
severity = "Medium"
detail = "/wp-admin/ accessible: WordPress admin panel."
tag = "admin"

[[checks]]
path = "/manager/html"
title = "Tomcat Manager exposed"
severity = "High"
detail = "Tomcat Manager (may allow WAR deployment)."
tag = "admin"

[[checks]]
path = "/phpmyadmin/"
title = "phpMyAdmin exposed"
severity = "High"
detail = "phpMyAdmin (database management UI)."
tag = "admin"

[[checks]]
path = "/adminer.php"
title = "Adminer exposed"
severity = "High"
detail = "Adminer database tool accessible."
tag = "admin"

# ── Framework debug / profiler pages ─────────────────────────────────────────

[[checks]]
path = "/phpinfo.php"
title = "phpinfo() exposed"
severity = "High"
detail = "phpinfo() (full PHP config and env vars)."
tag = "debug"
content_probe = "phpinfo()"

[[checks]]
path = "/info.php"
title = "PHP info exposed"
severity = "High"
detail = "PHP info page accessible."
tag = "debug"
content_probe = "phpinfo()"

[[checks]]
path = "/server-status"
title = "Apache mod_status exposed"
severity = "Medium"
detail = "Apache server-status (request counts, load, client IPs)."
tag = "debug"
content_probe = "Apache"

[[checks]]
path = "/server-info"
title = "Apache mod_info exposed"
severity = "Medium"
detail = "Apache server-info (full server config)."
tag = "debug"

[[checks]]
path = "/console"
title = "Console endpoint exposed"
severity = "High"
detail = "/console accessible (may be H2 console, Groovy REPL, or debug console)."
tag = "debug"

[[checks]]
path = "/trace.axd"
title = "ASP.NET trace exposed"
severity = "High"
detail = "ASP.NET trace.axd (detailed request/response trace with session data)."
tag = "debug"

[[checks]]
path = "/elmah.axd"
title = "ELMAH error log exposed"
severity = "High"
detail = "ELMAH error log (full ASP.NET exception detail with stack traces)."
tag = "debug"
content_probe = "Error"

[[checks]]
path = "/_profiler/"
title = "Symfony profiler exposed"
severity = "High"
detail = "Symfony Web Profiler (full request debug info including DB queries, logs)."
tag = "debug"

[[checks]]
path = "/__debug_toolbar__/"
title = "Django debug toolbar exposed"
severity = "Medium"
detail = "Django Debug Toolbar endpoints (may expose SQL queries and request data)."
tag = "debug"

[[checks]]
path = "/rails/info/properties"
title = "Rails info exposed"
severity = "High"
detail = "/rails/info/properties: Ruby on Rails server info and environment."
tag = "debug"
content_probe = "Rails"

[[checks]]
path = "/rails/info/routes"
title = "Rails routes exposed"
severity = "High"
detail = "/rails/info/routes (full URL routing table)."
tag = "debug"
content_probe = "helper"

[[checks]]
path = "/telescope/requests"
title = "Laravel Telescope exposed"
severity = "High"
detail = "Laravel Telescope (request/query/exception log with full payloads)."
tag = "debug"

[[checks]]
path = "/horizon/dashboard"
title = "Laravel Horizon exposed"
severity = "Medium"
detail = "Laravel Horizon (queue monitoring dashboard)."
tag = "debug"

# ── API documentation ─────────────────────────────────────────────────────────

[[checks]]
path = "/api/swagger.json"
title = "Swagger API spec exposed"
severity = "Medium"
detail = "Swagger/OpenAPI spec (full API surface with parameters disclosed)."
tag = "api-docs"
content_probe = "swagger"

[[checks]]
path = "/api/openapi.json"
title = "OpenAPI spec exposed"
severity = "Medium"
detail = "OpenAPI spec exposed."
tag = "api-docs"
content_probe = "openapi"

[[checks]]
path = "/v1/swagger.json"
title = "Swagger v1 spec exposed"
severity = "Medium"
detail = "Swagger API spec v1."
tag = "api-docs"
content_probe = "swagger"

[[checks]]
path = "/v2/api-docs"
title = "SpringFox API docs exposed"
severity = "Medium"
detail = "SpringFox Swagger2 API docs (full Spring Boot API surface)."
tag = "api-docs"
content_probe = "swagger"

[[checks]]
path = "/openapi.yaml"
title = "OpenAPI YAML exposed"
severity = "Medium"
detail = "OpenAPI YAML spec exposed."
tag = "api-docs"
content_probe = "openapi"

[[checks]]
path = "/swagger-ui/"
title = "Swagger UI exposed"
severity = "Medium"
detail = "Swagger UI (interactive API browser)."
tag = "api-docs"

[[checks]]
path = "/redoc/"
title = "ReDoc API docs exposed"
severity = "Low"
detail = "ReDoc API documentation UI."
tag = "api-docs"

# ── Java / J2EE ───────────────────────────────────────────────────────────────

[[checks]]
path = "/WEB-INF/web.xml"
title = "Java web.xml exposed"
severity = "High"
detail = "WEB-INF/web.xml (servlet mappings and filter config)."
tag = "java"
content_probe = "web-app"

[[checks]]
path = "/WEB-INF/applicationContext.xml"
title = "Spring context exposed"
severity = "High"
detail = "Spring applicationContext.xml (bean definitions and data sources)."
tag = "java"
content_probe = "beans"

# ── Mac filesystem artifact ───────────────────────────────────────────────────

[[checks]]
path = "/.DS_Store"
title = ".DS_Store exposed"
severity = "Medium"
detail = ".DS_Store file (reveals directory structure and file names on macOS-hosted server)."
tag = "disclosure"

[[checks]]
path = "/crossdomain.xml"
title = "crossdomain.xml exposed"
severity = "Low"
detail = "Flash crossdomain policy (reveals allowed cross-origin access rules)."
tag = "disclosure"
content_probe = "<cross"

# ── Monitoring endpoints ──────────────────────────────────────────────────────

[[checks]]
path = "/metrics"
title = "Prometheus metrics exposed"
severity = "Medium"
detail = "/metrics endpoint: Prometheus metrics reveal service internals, versions, and infra."
tag = "metrics"
content_probe = "# HELP"

[[checks]]
path = "/prometheus"
title = "Prometheus UI exposed"
severity = "Medium"
detail = "Prometheus dashboard accessible."
tag = "metrics"

# ── Security contact ──────────────────────────────────────────────────────────

[[checks]]
path = "/security.txt"
title = "security.txt present"
severity = "Info"
detail = "/security.txt found (review contact and disclosure policy)."
tag = "security-txt"
content_probe = "Contact"

[[checks]]
path = "/.well-known/security.txt"
title = "security.txt present"
severity = "Info"
detail = "/.well-known/security.txt found."
tag = "security-txt"
content_probe = "Contact"