fix matcher

Create exposed-gitattributes.yaml
2026-11-07 08:36:19 -10:00 · 2025-11-26 13:44:53 +05:30 · 2025-11-26 13:39:03 +05:30
1 changed files with 38 additions and 0 deletions
@@ -0,0 +1,38 @@
+id: exposed-gitattributes
+
+info:
+  name: .gitattributes File Exposure
+  author: ritikchaddha
+  severity: info
+  description: |
+    Detects publicly accessible .gitattributes files that may reveal repository structure, custom merge strategies, or other configuration details useful for reconnaissance.
+  reference:
+    - https://git-scm.com/docs/gitattributes
+  metadata:
+    max-request: 1
+    verified: true
+  tags: exposure,git,config
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.gitattributes"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - '(?m)^\*\s+text=auto'
+          - '(?m)^\*\.sh\s+text\s+eol=lf'
+          - '(?m)^\*\.bat\s+text\s+eol=crlf'
+          - '(?m)^\*\.jpg\s+-text'
+
+      - type: word
+        part: content_type
+        words:
+          - "text/plain"
+
+      - type: status
+        status:
+          - 200
Author	SHA1	Message	Date
Ritik Chaddha	5f0d1c97ec	fix matcher	2025-11-26 13:44:53 +05:30
Ritik Chaddha	2a8d1d5e83	Create exposed-gitattributes.yaml	2025-11-26 13:39:03 +05:30