Dork:
intitle:"Apache Struts 2.5" "index of /" -git
Explanation:
intitle:"Apache Struts 2.5": This part specifies that the search results
must have the words "Apache Struts 2.5" in the title. It helps narrow down
the results to instances related specifically to Apache Struts version 2.5.
"index of /": This part looks for directories with the "index of /" string.
Such directories often contain a listing of files and folders, which could
be unintentionally exposed and may include sensitive information.
-git: This part excludes results that contain the term "git". The idea is
to filter out Git repositories from the search results, focusing on other
types of exposed directories.
*Sample output : *
https://mirror.softaculous.com/apache/struts/2.5.30/
https://ftp.unicamp.br/pub/apache/struts/2.5.25/
https://ftp.itu.edu.tr/Mirror/Apache/struts/2.5.32/
https://repository.jboss.org/maven2/apache-struts/struts/
https://mirrors.gigenet.com/apache/struts/
https://ftp.riken.jp/net/apache/struts/
https://mirror.math.princeton.edu/pub/apache/struts/
This Google dork is searching for instances where the title includes
"Apache Struts 2.5," and the webpage has a directory listing ("index of /")
but excludes any results related to Git repositories. The aim is to
identify potentially exposed Apache Struts 2.5 instances that might have
unintentionally revealed directory structures.
Additional Information:
Affected versions: Struts 2.x before 2.5.33 or 6.x before 6.3.0.2
Description: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50164
Thank you for your consideration.
Sincerely,
--
*Parth Jamodkar*
*CLoud security researcher 3*
*LinkedIn*
