title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — Confidential acquisitions document publicly readable"
id: "7d294e72-9d9b-4949-99af-80d59f513138"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_55d83cb2565624881aa3a65c.
    
    Detection gap observed:
    Probe a05-ftp-acquisitions-001 confirmed vulnerable. Indicator matched: status=200. Confidential acquisitions document publicly readable
    
    Recommended defense:
    Desabilitar listagem de diretórios (autoindex off em nginx, Options -Indexes em Apache). Mover arquivos sensíveis para fora do webroot. Aplicar policy de "deny by default" em arquivos estáticos.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_55d83cb2565624881aa3a65c"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-09-02"
tags:
  - attack.t1083
  - doesitdefend.severity.medium
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium
---
title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Administration UI route reachable without auth check on frontend"
id: "278a2e44-a95d-41be-8036-6ece5dfefffb"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_78bb407c13b6392b991d9d6b.
    
    Detection gap observed:
    Probe a01-admin-public-001 confirmed vulnerable. Indicator matched: status=200. Administration UI route reachable without auth check on frontend
    
    Recommended defense:
    Aplicar verificação de autorização por recurso (não apenas autenticação). Validar ownership via tenant_id/user_id antes de retornar dados. Implementar rate-limit por usuário em endpoints de enumeração.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_78bb407c13b6392b991d9d6b"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high
---
title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — Order-by SQL injection via sort param (error-based detection)"
id: "bf3cc2d2-8e08-459a-accb-1ca3f202429c"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_3eb5ebd82066b4f73e59ed07.
    
    Detection gap observed:
    Probe a03-sqli-order-by-001 confirmed vulnerable. Indicator matched: status=400. Order-by SQL injection via sort param (error-based detection)
    
    Recommended defense:
    Usar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_3eb5ebd82066b4f73e59ed07"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high
---
title: "OWASP A09 — Logging/Security Logging Failure (key/secret directory exposure) — OWASP A09 — Encryption keys directory listing leaks premium.key"
id: "407d1806-6cbb-4d9a-b274-dde2253bbedd"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_78b5670f10d807933c74cba0.
    
    Detection gap observed:
    Probe a09-secret-keys-001 confirmed vulnerable. Indicator matched: body~"premium.key". Encryption keys directory listing leaks premium.key
    
    Recommended defense:
    Não expor diretórios de keys/secrets via webroot. Rotacionar chaves comprometidas. Centralizar gestão de segredos em Secret Manager/Vault.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_78b5670f10d807933c74cba0"
  - "https://attack.mitre.org/techniques/T1552/001/"
date: "2026-09-02"
tags:
  - attack.t1552.001
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  response_keywords:
    - premium.key
    - private.key
    - id_rsa
    - .pem
  condition: response_keywords
falsepositives:
  - "Public example keys clearly marked as canaries"
level: high
---
title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — FTP directory listing exposed at /ftp"
id: "5f050c8f-a82e-4eac-8666-523132376abb"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_2f37f74691dbdd1446ecd5c5.
    
    Detection gap observed:
    Probe a05-ftp-listing-001 confirmed vulnerable. Indicator matched: body~"package.json". FTP directory listing exposed at /ftp
    
    Recommended defense:
    Desabilitar listagem de diretórios (autoindex off em nginx, Options -Indexes em Apache). Mover arquivos sensíveis para fora do webroot. Aplicar policy de "deny by default" em arquivos estáticos.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_2f37f74691dbdd1446ecd5c5"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-09-02"
tags:
  - attack.t1083
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium
---
title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Poison-null byte path traversal bypasses .md whitelist"
id: "16e5ac7c-00c5-4eb5-a594-d6bf9e97663e"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_397197163781244b4bd9f324.
    
    Detection gap observed:
    Probe a01-pathtraversal-ftp-001 confirmed vulnerable. Indicator matched: body~"dependencies". Poison-null byte path traversal bypasses .md whitelist
    
    Recommended defense:
    Aplicar verificação de autorização por recurso (não apenas autenticação). Validar ownership via tenant_id/user_id antes de retornar dados. Implementar rate-limit por usuário em endpoints de enumeração.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_397197163781244b4bd9f324"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high
---
title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim"
id: "109fb36b-619a-49a5-b449-769cd9598dbd"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_c043f9519e867336ab446aae.
    
    Detection gap observed:
    Probe a03-sqli-search-001 confirmed vulnerable. Indicator matched: body~"SQLITE_ERROR". Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim
    
    Recommended defense:
    Usar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_c043f9519e867336ab446aae"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high
---
title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — SQL injection in login email bypasses authentication (classic ' OR 1=1--)"
id: "50564586-8dcd-4f5a-b0da-c3d9696b6caf"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_5aac2b8d7b14779c84680fc4.
    
    Detection gap observed:
    Probe a03-sqli-login-email-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection in login email bypasses authentication (classic ' OR 1=1--)
    
    Recommended defense:
    Usar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_5aac2b8d7b14779c84680fc4"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.critical
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high
---
title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — SQL injection with comment terminator bypasses password check"
id: "78cf2890-e833-4551-b05a-7f06cd047114"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_45ddd2c1b8ea1616cab7c391.
    
    Detection gap observed:
    Probe a03-sqli-login-quote-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection with comment terminator bypasses password check
    
    Recommended defense:
    Usar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_45ddd2c1b8ea1616cab7c391"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.critical
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high