title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — Confidential acquisitions document publicly readable"
id: "d906eb03-7618-4744-aa31-1fb337d0933e"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_4332622b59c4446e9bfec62b.
    
    Detection gap observed:
    Probe a05-ftp-acquisitions-001 confirmed vulnerable. Indicator matched: status=200. Confidential acquisitions document publicly readable
    
    Recommended defense:
    Disable directory listing (autoindex off on nginx, Options -Indexes on Apache). Move sensitive files out of the webroot. Apply deny-by-default policy to static files.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_4332622b59c4446e9bfec62b"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-10-17"
tags:
  - attack.t1083
  - doesitdefend.severity.medium
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium
---
title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — Order-by SQL injection via sort param (error-based detection)"
id: "558b5424-c722-467d-a0d3-5e083a7fcc90"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_425f826246bf433b94341eab.
    
    Detection gap observed:
    Probe a03-sqli-order-by-001 confirmed vulnerable. Indicator matched: status=400. Order-by SQL injection via sort param (error-based detection)
    
    Recommended defense:
    Use prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_425f826246bf433b94341eab"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high
---
title: "OWASP A09 — Logging/Security Logging Failure (key/secret directory exposure) — OWASP A09 — Encryption keys directory listing leaks premium.key"
id: "5a290c00-b879-45b7-8d7a-f51df63b491d"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_6547b01c36d6a1d5d4b94ca9.
    
    Detection gap observed:
    Probe a09-secret-keys-001 confirmed vulnerable. Indicator matched: body~"premium.key". Encryption keys directory listing leaks premium.key
    
    Recommended defense:
    Never expose keystore/secret directories via the webroot. Rotate compromised keys. Centralize secret management in Secret Manager/Vault.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_6547b01c36d6a1d5d4b94ca9"
  - "https://attack.mitre.org/techniques/T1552/001/"
date: "2026-10-17"
tags:
  - attack.t1552.001
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  response_keywords:
    - premium.key
    - private.key
    - id_rsa
    - .pem
  condition: response_keywords
falsepositives:
  - "Public example keys clearly marked as canaries"
level: high
---
title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — FTP directory listing exposed at /ftp"
id: "e7e01f4d-fa88-49e4-a333-9373b3057e3e"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_79939de458c2d65832fe5c21.
    
    Detection gap observed:
    Probe a05-ftp-listing-001 confirmed vulnerable. Indicator matched: body~"package.json". FTP directory listing exposed at /ftp
    
    Recommended defense:
    Disable directory listing (autoindex off on nginx, Options -Indexes on Apache). Move sensitive files out of the webroot. Apply deny-by-default policy to static files.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_79939de458c2d65832fe5c21"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-10-17"
tags:
  - attack.t1083
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium
---
title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Poison-null byte path traversal bypasses .md whitelist"
id: "c699462a-7f0b-4e8a-85ef-d2ddbe0ee7f4"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_47014c49d28d1fccb5cfda33.
    
    Detection gap observed:
    Probe a01-pathtraversal-ftp-001 confirmed vulnerable. Indicator matched: body~"dependencies". Poison-null byte path traversal bypasses .md whitelist
    
    Recommended defense:
    Enforce per-resource authorization (not just authentication). Validate ownership via tenant_id/user_id before returning data. Add per-user rate limits on enumeration-prone endpoints.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_47014c49d28d1fccb5cfda33"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high
---
title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim"
id: "acf15471-53c8-4e1e-a285-7968577ae90c"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_98cf750876b07be7206b511a.
    
    Detection gap observed:
    Probe a03-sqli-search-001 confirmed vulnerable. Indicator matched: body~"SQLITE_ERROR". Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim
    
    Recommended defense:
    Use prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_98cf750876b07be7206b511a"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high
---
title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Administration UI route reachable without auth check on frontend"
id: "14fe93f1-6acc-4c0c-b922-a0044f3b2144"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_36ae87c68f8649fc3c34fbd9.
    
    Detection gap observed:
    Probe a01-admin-public-001 confirmed vulnerable. Indicator matched: status=200. Administration UI route reachable without auth check on frontend
    
    Recommended defense:
    Enforce per-resource authorization (not just authentication). Validate ownership via tenant_id/user_id before returning data. Add per-user rate limits on enumeration-prone endpoints.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_36ae87c68f8649fc3c34fbd9"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high
---
title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — SQL injection in login email bypasses authentication (classic ' OR 1=1--)"
id: "59a31512-f215-411c-adf8-fbcb32a229d2"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_4df9523ae45a733ea774c535.
    
    Detection gap observed:
    Probe a03-sqli-login-email-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection in login email bypasses authentication (classic ' OR 1=1--)
    
    Recommended defense:
    Use prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_4df9523ae45a733ea774c535"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.critical
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high
---
title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — SQL injection with comment terminator bypasses password check"
id: "04a55d74-5d70-440b-afb1-d2d155dc3e72"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_de95686591a63621af9ee245.
    
    Detection gap observed:
    Probe a03-sqli-login-quote-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection with comment terminator bypasses password check
    
    Recommended defense:
    Use prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_de95686591a63621af9ee245"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.critical
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high