loading
Loading content
loading
Vulnerability Scanning
Probe known paths for .env, .git/config, logs, and dev artifacts, and validate the body looks like a real file. Cuts soft-404s across a URL fleet.
Sensitive files exposed on the web root are configs, logs, .git metadata, and .env files that hand credentials and source to anyone who knows the path. This module probes known paths for those files and validates the response body so a soft-404 does not become a finding. It runs across thousands of web servers in one pass.
You feed a live URL list. The module probes known paths for configs, logs, .git, .env, .aws/credentials, and other development artifacts, then validates the response body so a status code alone is not a finding. It does not hunt hostname-named backup archives, and it does not run a body-wide secret regex across HTML. Flags live on tool pages; the hard problem here is telling a real config from a soft-404.
Live URLs from Probe for Web Servers. Nested .env and .git/config need path seeds from Discover Paths via Crawling or Discover Paths via Directory Brute Force.
findings into Generate Scan Report.
The other exposed-artifact modules on the same URL list: Scan for Exposed Admin Panels, Scan for Exposed Backups, and Scan for Exposed Secrets. Each owns a different artifact class. Do not share one H1.
Nest this after you have live web URLs and you want to know which known sensitive-file paths serve real content. A root-only URL list misses nested .env and .git/config; nest after path discovery for that coverage.
urls (FILE): live HTTP URLs, one per line. Example: https://foo.example.com, https://bar.example.com/app.
header (STRING): header(s) to include in HTTP requests.
header-file (FILE): file of header(s) to include.
rate-limit (STRING): max requests per second per machine. Default 300.
findings: JSONLines of finding details. Published fields: finding, location, severity, hostname, domain_name, ip_address, method, description, and (v1.2.1) the HTTP request that triggered the row. README examples: Git Configuration at /.git/config (medium) and AWS Credentials at /.aws/credentials (high).
The tables this module produces. Sample rows are illustrative.
Sensitive files at known paths whose response body validated as a real file.
findingtext | locationurl | severitytext | hostnametext | domain_nametext | ip_addresstext | methodtext | descriptiontext | requesttext | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Git Configuration | https://app.example.com/.git/config | medium | app.example.com | example.com | 203.0.113.10 | GET | Repository config exposed at /.git/config. | GET /.git/config HTTP/1.1 |
| 2 | AWS Credentials | https://app.example.com/.aws/credentials | high | app.example.com | example.com | 203.0.113.10 | GET | Cloud credential file exposed at /.aws/credentials. | GET /.aws/credentials HTTP/1.1 |
| 3 | Environment File | https://api.example.com/.env | high | api.example.com | example.com | 198.51.100.42 | GET | Application .env file served from the web root. | GET /.env HTTP/1.1 |
Artifact class it owns
Management / login UI; default creds on a subset
Upstream it needs
live urls
Artifact class it owns
Hostname-named .bak/.sql/zip/tarball
Upstream it needs
live urls
Artifact class it owns
Patterns in the response you fetched
Upstream it needs
live urls
Scan for Sensitive Files
Artifact class it owns
.env, .git/config, logs, dev artifacts
Upstream it needs
live urls
questions
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.