id: shellscripts

info:
  name: Public shellscripts
  author: panch0r3d
  severity: low
  description: This template checks exposure of bash scripts.
  metadata:
    max-request: 27
  tags: bash,exposure,files

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
    payloads:
      paths:
        - "/.build.sh"
        - "/.jenkins.sh"
        - "/.travis.sh"
        - "/install.sh"
        - "/update.sh"
        - "/upload.sh"
        - "/config.sh"
        - "/build.sh"
        - "/setup.sh"
        - "/run.sh"
        - "/backup.sh"
        - "/compile.sh"
        - "/env.sh"
        - "/init.sh"
        - "/startup.sh"
        - "/wp-setup.sh"
        - "/deploy.sh"
        - "/aws.sh"
        - "/reminder.sh"
        - "/mysqlbackup.sh"
        - "/dev2local.sh"
        - "/local2dev.sh"
        - "/local2prod.sh"
        - "/prod2local.sh"
        - "/rsync.sh"
        - "/sync.sh"
        - "/test.sh"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - ".*?bin.*?sh"
          - ".*?bin.*?bash"
        condition: or

      - type: word
        part: header
        words:
          - "application/x-sh"
          - "text/plain"
          - "text/x-sh"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a0047304502201d5038b0b5380e452e6bf5892d3c086ec669613e50c1c66d7b25e5b72459fa7a02210086a4e4f8877f409ad1c45c5f5cdc40272887991981d8055f53920d1f6aba1f91:922c64590222798bb761d5b6d8e72950