diff --git a/other/APIs/couchbase-unauth-apis.bcheck b/other/APIs/couchbase-unauth-apis.bcheck new file mode 100644 index 0000000..39e6290 --- /dev/null +++ b/other/APIs/couchbase-unauth-apis.bcheck @@ -0,0 +1,27 @@ +metadata: + language: v2-beta + name: "Couchbase Buckets Unauthenticated REST API - Detect" + description: "Couchbase Buckets REST API without authentication was detected" + author: "Nithissh" + +run for each: + # you could add more values to this list to make the check repeat + potential_path = + "/pools/default/buckets" + +given host then + send request called check: + method: "GET" + path: {potential_path} + + if {check.response.status_code} is "200" + and "couchbase" in {check.response.body} + and "bucket" in {check.response.body} + and "data" in {check.response.body} + and "application/json" in {check.response.headers} then + report issue: + severity: medium + confidence: certain + remediation: "Public access should be revoked" + detail: `Couchbase bucket publicly exposed on {potential_path}.` + end if diff --git a/other/configs/apache-airflow-config-exposure.bcheck b/other/configs/apache-airflow-config-exposure.bcheck new file mode 100644 index 0000000..db26dde --- /dev/null +++ b/other/configs/apache-airflow-config-exposure.bcheck @@ -0,0 +1,23 @@ +metadata: + language: v2-beta + name: "Apache Airflow Configuration Page" + description: "Apache Airflow configuration page was detected" + author: "Nithissh" + +run for each: + # you could add more values to this list to make the check repeat + potential_path = + "airflow.cfg" + +given host then + send request called check: + method: "GET" + path: {potential_path} + + if "[core]" in {check.response.body} and "[api]" in {check.response.body} then + report issue: + severity: medium + confidence: certain + detail: `Apache airflow configuration page found on {potential_path}.` + remediation: "Ensure your Apache airflow configuration page are not exposed." + end if diff --git a/other/configs/dockerrun-aws-config-page-exposure.bcheck b/other/configs/dockerrun-aws-config-page-exposure.bcheck new file mode 100644 index 0000000..658fd20 --- /dev/null +++ b/other/configs/dockerrun-aws-config-page-exposure.bcheck @@ -0,0 +1,23 @@ +metadata: + language: v2-beta + name: "Dockerrun AWS Configuration Page Exposed" + description: "Dockerrun AWS configuration page was detected" + author: "Nithissh" + +run for each: + # you could add more values to this list to make the check repeat + potential_path = + "/Dockerrun.aws.json" + +given host then + send request called check: + method: "GET" + path: {potential_path} + + if "AWSEBDockerrunVersion" in {latest.response} and "containerDefinitions" in {latest.response} then + report issue: + severity: medium + confidence: certain + detail: `Dockerrun AWS configuration page exposed on {potential_path}.` + remediation: "Make sure to disable the configuration page to public" + end if