feat: add curated internal network pocs

2026-09-27 05:31:53 +08:00 · 2026-07-16 01:45:09 +08:00
parent 61ae87d171
commit 621b2c2f24
52 changed files with 1230 additions and 0 deletions
@@ -0,0 +1,19 @@
+id: hadoop-disclosure
+
+info:
+  name: Apache Hadoop Disclosure
+  author: zan8in
+  severity: low
+  verified: true
+  description: |-
+    Apache Hadoop 存在目录浏览漏洞，攻击者可以通过访问/dfshealth.html来获取Hadoop集群的配置信息。
+  tags: hadoop,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /dfshealth.html
+    expression: response.status == 200 && response.body.bcontains(b'class="navbar-brand"') && response.body.bcontains(b'dfshealth.js')
+expression: r0()