gossan-hidden 0.3.3

Hidden endpoint and misconfiguration scanner for gossan (CORS, SSRF, JWT, Swagger, cache deception), part of the security research ecosystem
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167

# GENERATED from debug_endpoints::LEGACY_PROBES  -  DO NOT hand-edit.
# Regenerate: GOSSAN_GEN_HIDDEN=1 cargo test -p gossan-hidden emit_debug_endpoints_pack
# Tier-B recall FLOOR; extend via community *.toml under a
# `hidden-debug/` rules dir (see rules/hidden-debug/community/).

[[probe]]
path = "/actuator"
name = "Spring Boot Actuator Index"
framework = "Spring Boot"
severity = "high"
confirm_strings = [
    "_links",
    "actuator",
]

[[probe]]
path = "/actuator/env"
name = "Spring Boot Environment Variables"
framework = "Spring Boot"
severity = "critical"
confirm_strings = [
    "propertySources",
    "systemProperties",
]

[[probe]]
path = "/actuator/heapdump"
name = "Spring Boot Heap Dump"
framework = "Spring Boot"
severity = "critical"
confirm_strings = []

[[probe]]
path = "/actuator/configprops"
name = "Spring Boot Config Properties"
framework = "Spring Boot"
severity = "high"
confirm_strings = [
    "beans",
    "prefix",
]

[[probe]]
path = "/actuator/mappings"
name = "Spring Boot Request Mappings"
framework = "Spring Boot"
severity = "medium"
confirm_strings = [
    "dispatcherServlets",
    "requestMappingConditions",
]

[[probe]]
path = "/__debug__/"
name = "Django Debug Toolbar"
framework = "Django"
severity = "critical"
confirm_strings = [
    "djDebug",
    "debug toolbar",
]

[[probe]]
path = "/debug/pprof/"
name = "Go pprof Profiler"
framework = "Go net/http/pprof"
severity = "high"
confirm_strings = [
    "goroutine",
    "heap",
    "profile",
]

[[probe]]
path = "/metrics"
name = "Prometheus Metrics Endpoint"
framework = "Prometheus"
severity = "medium"
confirm_strings = [
    "# HELP",
    "# TYPE",
    "process_",
]

[[probe]]
path = "/healthz"
name = "Kubernetes Health Check"
framework = "Kubernetes"
severity = "info"
confirm_strings = []

[[probe]]
path = "/server-status"
name = "Apache Server Status"
framework = "Apache httpd"
severity = "medium"
confirm_strings = [
    "Apache Server Status",
    "Total Accesses",
]

[[probe]]
path = "/server-info"
name = "Apache Server Info"
framework = "Apache httpd"
severity = "high"
confirm_strings = [
    "Server Settings",
    "Module Name",
]

[[probe]]
path = "/_profiler/"
name = "Symfony Web Profiler"
framework = "Symfony"
severity = "high"
confirm_strings = [
    "sf-toolbar",
    "profiler",
]

[[probe]]
path = "/elmah.axd"
name = "ELMAH Error Log"
framework = "ASP.NET ELMAH"
severity = "high"
confirm_strings = [
    "Error Log for",
    "ELMAH",
]

[[probe]]
path = "/trace.axd"
name = "ASP.NET Trace"
framework = "ASP.NET"
severity = "high"
confirm_strings = [
    "Application Trace",
    "Request Details",
]

[[probe]]
path = "/info.php"
name = "PHP Info Page"
framework = "PHP"
severity = "medium"
confirm_strings = [
    "phpinfo()",
    "PHP Version",
]

[[probe]]
path = "/graphiql"
name = "GraphiQL IDE Exposed"
framework = "GraphQL"
severity = "medium"
confirm_strings = [
    "graphiql",
    "GraphiQL",
]

[[probe]]
path = "/__webpack_hmr"
name = "Webpack HMR Endpoint"
framework = "Webpack Dev Server"
severity = "medium"
confirm_strings = []