shell-history: Shell History

id: shell-history

info:
  name: Shell History
  author: pentest_swissky,geeknik
  severity: low
  description: Discover history for bash, ksh, sh, and zsh
  metadata:
    max-request: 4
  tags: misconfig,vuln

http:
  - method: GET
    max-redirects: 1
    path:
      - "{{BaseURL}}/.bash_history"
      - "{{BaseURL}}/.ksh_history"
      - "{{BaseURL}}/.sh_history"
      - "{{BaseURL}}/.zsh_history"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "mkdir "
          - "chmod "
          - "mv "
          - "nano "
          - "vim "
          - "pico "
          - "sudo "
          - "cd "
          - "cp "
          - "ps aux"
          - "ls "
          - "logout"
        condition: or

      - type: word
        part: response
        words:
          - "<?xml"
          - "<env"
          - "application/javascript"
          - "application/json"
          - "application/xml"
          - "html>"
          - "text/html"
          - "image/"
        negative: true

      - type: status
        status:
          - 200
# digest: 490a00463044022036ce7386216d3fd36d33b3a177d81187105e56dc398bb0b00750f0a75b7d048e02207275f24a37d2132f79a9d2b7218d2c2129bc998df57e316ffdf12c38226573ca:922c64590222798bb761d5b6d8e72950