Source Code Enumeration Detection by Keyword

Detects source code enumeration that use GET requests by keyword searches in URL strings

Rule Content

- title: Source Code Enumeration Detection by Keyword
  id: 953d460b-f810-420a-97a2-cfca4c98e602
  description: Detects source code enumeration that use GET requests by keyword searches
    in URL strings
  author: James Ahearn
  references:
  - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html
  - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1
  logsource:
    category: webserver
    product: null
    service: null
  detection:
    keywords:
    - '*.git/*'
    condition: keywords
  fields:
  - client_ip
  - vhost
  - url
  - response
  falsepositives:
  - unknown
  level: medium

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='*.git\/*')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()