Tried this rule:
plugins:
- checks:
- name: Database file
match:
- "\x1F\x8B\x08"
remediation: Delete this file
description: Verifies a database dump is accessible.
severity: "High"
uri: /db.sqlite3.tar.gz
On my test server, it correctly hits the file:
[verbose] Testing URL: http://0.0.0.0:8000/db.sqlite3.tar.gz
And I see it as 200 in the logs:
127.0.0.1 - - [24/Oct/2020 16:54:38] "GET /db.sqlite3.tar.gz HTTP/1.1" 200 -
Returning the expected bytes:
$ curl 0:8000/db.sqlite3.tar.gz | hexdump -C | head -n 1
00000000 1f 8b 08 00 00 00 00 00 00 03 ec 9d 79 6c 1c d7 |............yl..|
But the match may fail, as ChopChop does not report it:
$ ./gochopchop scan --url http://0.0.0.0:8000
No vulnerabilities found.
So either I'm tired, either ChopChop don't want to match arbitrary bytes sequences?
Tried this rule:
On my test server, it correctly hits the file:
And I see it as 200 in the logs:
Returning the expected bytes:
But the match may fail, as ChopChop does not report it:
So either I'm tired, either ChopChop don't want to match arbitrary bytes sequences?