dwr-index-detect: DWR detect test page detection

2025-08-01 DWR PoC Public

Description

The index contains the list of exposed Java classes. From here one can navigate to the test page of each class where every callable method is described and can be easily tested. This is a great way to find out what methods are exposed and learn how they function.

PoC

id: dwr-index-detect

info:
  name: DWR detect test page detection
  author: pussycat0x
  severity: low
  description: The index contains the list of exposed Java classes. From here one can navigate to the test page of each class where every callable method is described and can be easily tested. This is a great way to find out what methods are exposed and learn how they function.
  reference:
    - http://aetherlab.net/2012/09/experiences-in-pentesting-dwr/
  metadata:
    max-request: 1
    google-query: intitle:"DWR Test Index"
  tags: tech,misconfig,dwr,discovery

http:
  - method: GET
    path:
      - '{{BaseURL}}/dwr/index.html'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>DWR Test Index</title>"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100eb39700c1bb7ebb45b71726c93b7b908d6e879d83440733b9cf63db29294f6da02204fc8fc092560cb6ca7f844355034b9665e636bee4a269ab2d39cd358fd6db9c1:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/technologies/dwr-index-detect.yaml

References

Related Vulnerabilities