makefile-exposure: Makefile - Exposure

id: makefile-exposure

info:
  name: Makefile - Exposure
  author: 0x_Akoko
  severity: low
  description: |
    Detected Makefile configuration file was identified, which potentially exposed build process details, author information, and directory structure
  reference:
    - https://www.gnu.org/software/make/manual/make.html
  metadata:
    verified: true
    max-request: 2
  tags: exposure,config,makefile,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Makefile"
      - "{{BaseURL}}/makefile"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "PHONY:", "all:", "clean:", ".SUFFIXES:", "$(MAKE)")'
          - '!contains_any(body,"<!DOCTYPE","<html","<script>")'
          - 'len(body) > 100 && len(body) < 100000'
        condition: and
# digest: 490a0046304402203bbd6b8be50ae71fca1103eed389c4a2817d0baded1343fb2fb7eb7494450224022014b4e815337101cd984f8745ec0261479382815c73760467b31c5b6ed0e8cd74:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.