mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
35 lines
749 B
YAML
35 lines
749 B
YAML
id: gitlab-api-user-enum
|
|
|
|
info:
|
|
name: GitLab - User Information Disclosure Via Open API
|
|
author: Suman_Kar
|
|
severity: medium
|
|
reference:
|
|
- https://gitlab.com/gitlab-org/gitlab-foss/-/issues/40158
|
|
tags: gitlab,api,enum,user
|
|
created: 2023/07/20
|
|
|
|
rules:
|
|
r0:
|
|
brute:
|
|
mode: sniper
|
|
commit: winner
|
|
continue: false
|
|
uid:
|
|
- "1"
|
|
- "2"
|
|
- "3"
|
|
- "4"
|
|
- "5"
|
|
- "6"
|
|
- "7"
|
|
- "8"
|
|
- "9"
|
|
- "10"
|
|
- "2"
|
|
request:
|
|
method: GET
|
|
path: /api/v4/users/{{uid}}
|
|
expression: response.status == 200 && response.body.bcontains(b'"id":') && response.body.bcontains(b'"username":') && response.body.bcontains(b'"name":')
|
|
expression: r0()
|