id: wordpress-tmm-db-migrate

info:
  name: WordPress ThemeMarkers DB Migration File
  author: dwisiswant0
  severity: info
  metadata:
    max-request: 1
  tags: wordpress,wp-plugin,backup,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/tmm_db_migrate/tmm_db_migrate.zip"

    max-size: 1000

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "application/zip"
        part: header

      - type: regex
        regex:
          - "[a-z0-9_]+.dat"
        part: body

      - type: status
        status:
          - 200

      - type: binary
        binary:
          - "504B0304" # zip
# digest: 490a0046304402206ddb6796957833f78dd623d624981f4c6b84610830c2848be63df665fd3bc3a70220057dbaa0d947d579a065aacfed54847d583bb7f239d2c88519d29640a8f406a3:922c64590222798bb761d5b6d8e72950