arxsentinel/deploy/examples/cms/generic-php.yaml at dev · mr-addams/arxsentinel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# arxsentinel — Generic PHP application probe paths override
#
# Covers common misconfigurations and exposed tools found in custom PHP apps,
# legacy codebases, and shared hosting environments.
# Use this config if you are not running a specific CMS.
#
# Usage:
#   Merge detectors.probe.paths into your config.yaml.
#
# Apply without restart:
#   kill -HUP $(pgrep arxsentinel)   # or systemctl kill -s HUP arxsentinel

detectors:
  probe:
    paths:
      # ── PHP info and diagnostics — never leave these in production ────────────────────
      - /phpinfo.php
      - /phpinfo/
      - /info.php
      - /php.php
      - /test.php
      - /check.php

      # ── Database admin tools ───────────────────────────────────────────────────────────
      - /phpmyadmin/           # phpMyAdmin — direct database access
      - /pma/                  # common phpMyAdmin alias
      - /myadmin/
      - /mysql/
      - /adminer.php           # Adminer — single-file database manager
      - /adminer/

      # ── Environment and configuration files ───────────────────────────────────────────
      - /.env
      - /.env.backup
      - /config.php
      - /config.inc.php        # common legacy config filename
      - /conf.php
      - /database.php
      - /db.php
      - /settings.php
      - /local.php

      # ── Backup and archive files left in web root ─────────────────────────────────────
      - /backup.zip
      - /backup.tar.gz
      - /backup.sql
      - /backup.sql.gz
      - /db.sql
      - /database.sql
      - /dump.sql
      - /site.zip
      - /www.zip

      # ── VCS — source code exposure ───────────────────────────────────────────────────
      - /.git/
      - /.git/config
      - /.git/HEAD
      - /.svn/entries

      # ── Composer artifacts ────────────────────────────────────────────────────────────
      - /composer.json
      - /composer.lock
      - /vendor/

      # ── Exposed log and error files ────────────────────────────────────────────────────
      - /error_log
      - /error.log
      - /php_error.log
      - /application.log