env_exposed.yaml

id: env-exposed

info:
  name: .env File Discovery
  author: BooBooHQ
  severity: high
  description: .env file was discovered.
  tags: config,exposure,codeigniter

requests:
  - method: GET
    path:
      - "{{BaseURL}}/.env"
      - "{{BaseURL}}/.env.backup"
      - "{{BaseURL}}/.env.bak"
      - "{{BaseURL}}/.env.config"
      - "{{BaseURL}}/.env.dev"
      - "{{BaseURL}}/.env.dev.local"
      - "{{BaseURL}}/.env.development.local"
      - "{{BaseURL}}/.env.example"
      - "{{BaseURL}}/.env.live"
      - "{{BaseURL}}/.env.local"
      - "{{BaseURL}}/.env.old"
      - "{{BaseURL}}/.env.prod"
      - "{{BaseURL}}/.env.prod.local"
      - "{{BaseURL}}/.env.production"
      - "{{BaseURL}}/.env.production.local"
      - "{{BaseURL}}/.env.save"
      - "{{BaseURL}}/.env.stage"
      - "{{BaseURL}}/.env.staging"
      - "{{BaseURL}}/.env.testing"
      - "{{BaseURL}}/.env.www"
      - "{{BaseURL}}/.env_1"
      - "{{BaseURL}}/.env_sample"
      - "{{BaseURL}}/.envrc"
      - "{{BaseURL}}/actuator/env"
      - "{{BaseURL}}/actuators/env"
      - "{{BaseURL}}/api/.env"
      - "{{BaseURL}}/cgi-bin/printenv.pl"
      - "{{BaseURL}}/conf/cassandra-env.sh"
      - "{{BaseURL}}/config/environment.rb"
      - "{{BaseURL}}/env"
      - "{{BaseURL}}/env.dev.js"
      - "{{BaseURL}}/env.development.js"
      - "{{BaseURL}}/env.js"
      - "{{BaseURL}}/env.prod.js"
      - "{{BaseURL}}/env.production.js"
      - "{{BaseURL}}/env.sh"
      - "{{BaseURL}}/env.test.js"
      - "{{BaseURL}}/environment.rb"
      - "{{BaseURL}}/proc/self/environ"
      - "{{BaseURL}}/redmine/config/environment.rb"
      - "{{BaseURL}}/..;/.env"
      - "{{BaseURL}}/..;/.env.backup"
      - "{{BaseURL}}/..;/.env.bak"
      - "{{BaseURL}}/..;/.env.config"
      - "{{BaseURL}}/..;/.env.dev"
      - "{{BaseURL}}/..;/.env.dev.local"
      - "{{BaseURL}}/..;/.env.development.local"
      - "{{BaseURL}}/..;/.env.example"
      - "{{BaseURL}}/..;/.env.live"
      - "{{BaseURL}}/..;/.env.local"
      - "{{BaseURL}}/..;/.env.old"
      - "{{BaseURL}}/..;/.env.prod"
      - "{{BaseURL}}/..;/.env.prod.local"
      - "{{BaseURL}}/..;/.env.production"
      - "{{BaseURL}}/..;/.env.production.local"
      - "{{BaseURL}}/..;/.env.save"
      - "{{BaseURL}}/..;/.env.stage"
      - "{{BaseURL}}/..;/.env.staging"
      - "{{BaseURL}}/..;/.env.testing"
      - "{{BaseURL}}/..;/.env.www"
      - "{{BaseURL}}/..;/.env_1"
      - "{{BaseURL}}/..;/.env_sample"
      - "{{BaseURL}}/..;/.envrc"
      - "{{BaseURL}}/..;/actuator/env"
      - "{{BaseURL}}/..;/actuators/env"
      - "{{BaseURL}}/..;/api/.env"
      - "{{BaseURL}}/..;/cgi-bin/printenv.pl"
      - "{{BaseURL}}/..;/conf/cassandra-env.sh"
      - "{{BaseURL}}/..;/config/environment.rb"
      - "{{BaseURL}}/..;/env"
      - "{{BaseURL}}/..;/env.dev.js"
      - "{{BaseURL}}/..;/env.development.js"
      - "{{BaseURL}}/..;/env.js"
      - "{{BaseURL}}/..;/env.prod.js"
      - "{{BaseURL}}/..;/env.production.js"
      - "{{BaseURL}}/..;/env.sh"
      - "{{BaseURL}}/..;/env.test.js"
      - "{{BaseURL}}/..;/environment.rb"
      - "{{BaseURL}}/..;/proc/self/environ"
      - "{{BaseURL}}/..;/redmine/config/environment.rb"
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "(?m)^APP_(NAME|ENV|KEY|DEBUG|URL|PASSWORD)"
          - "(?m)^DB_(HOST|PASSWORD|DATABASE)"
        condition: or

      - type: status
        status:
          - 200