sqlite-history-exposure: SQLite History - Exposure

id: sqlite-history-exposure

info:
  name: SQLite History - Exposure
  author: theamanrawat
  severity: medium
  description: |
    Detects exposed .sqlite_history files. These files contain SQLite command history, including executed queries, table names, and potentially sensitive data that was queried or inserted.
  impact: |
    Exposed SQLite history can reveal database schema, table structures, sensitive SQL queries (with credentials or tokens), and business logic.
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"CREATE TABLE" http.html:"SELECT"
    fofa-query: body=".schema" && body="SELECT"
    google-dork: intitle:"index of" ".sqlite_history"
  tags: exposure,sqlite,history,database,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.sqlite_history"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(to_lower(body), "select", "insert", "create table", "update", "delete from", ".tables", ".schema",".databases")'
          - 'status_code == 200'
        condition: and

      - type: regex
        part: body
        regex:
          - '(?i)(select|insert|update|delete|create|alter|drop|\.quit|\.schema|\.tables).*[\r\n]+(select|insert|update|delete|create|alter|drop|\.quit|\.schema|\.tables)'

      - type: word
        part: body
        words:
          - "<html"
          - "<!DOCTYPE"
          - "<head"
          - "<body"
          - '{"'
          - '"error"'
          - '"message"'
        negative: true
# digest: 490a0046304402201e1583a24fb7e07bdbc50a75de85e21dccc50d249bafdacd12efe3bb393e196202206440b6f15258d16f29cf709a1694172b1b055a3ea808ebea044a08036c9eba74:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.