id: wpconfig-aws-keys

info:
  name: AWS S3 keys Leak
  author: r12w4n
  severity: high
  description: AWS S3 keys are exposed.
  metadata:
    max-request: 2
  tags: aws,s3,wordpress,disclosure,exposure

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-config.php-backup'
      - "{{BaseURL}}/%c0"

    matchers:
      - type: word
        words:
          - 'access-key-id'
          - 'secret-access-key'
          - 'DB_NAME'
          - 'DB_PASSWORD'
        condition: and
        part: body
# digest: 490a0046304402201bf8cbbedfbd367460058545793477f4d1232ff036595806080c7be54edb9ef90220228289872b7dde96169fd36ff27bcc9d0fa801eebe5332039ec102bddbff032e:922c64590222798bb761d5b6d8e72950