Referencia de checks¶
Todos los checks disponibles en RedBench v0.1.
Infrastructure (14 checks)¶
Estos checks se ejecutan siempre, independientemente de la plataforma detectada.
RB-INFRA-001 — Missing security headers¶
| Severidad | Medium |
| Modos | passive, safe-active, authenticated |
| Tags | headers, hardening, owasp |
Checks for missing HTTP security headers that protect against common web attacks (XSS, clickjacking, MIME sniffing, downgrade).
RB-INFRA-002 — Exposed .git directory¶
| Severidad | Critical |
| Modos | passive, safe-active, authenticated |
| Tags | git, leak, source-code |
Checks if the .git directory is publicly accessible, which can leak source code, credentials, and deployment history.
RB-INFRA-003 — Exposed backup files¶
| Severidad | Critical |
| Modos | passive, safe-active, authenticated |
| Tags | backup, leak, data |
Probes for common backup file patterns that leak database dumps, source archives, or configuration files.
RB-INFRA-004 — SSL/TLS configuration issues¶
| Severidad | High |
| Modos | passive, safe-active, authenticated |
| Tags | ssl, tls, certificate, hardening |
Validates certificate validity, expiration, and basic TLS posture.
RB-INFRA-005 — Server version disclosure¶
| Severidad | Low |
| Modos | passive, safe-active, authenticated |
| Tags | headers, information-disclosure, hardening |
Checks if the Server HTTP header discloses detailed version information (e.g. Apache/2.4.52, nginx/1.18.0). A generic server name without a version number is not flagged.
RB-INFRA-006 — Directory listing enabled¶
| Severidad | Medium |
| Modos | passive, safe-active, authenticated |
| Tags | directory-listing, information-disclosure, hardening |
Checks common paths for directory listing (Index of) which can expose internal file structures, backups, and sensitive assets.
RB-INFRA-007 — CORS misconfiguration¶
| Severidad | High |
| Modos | passive, safe-active, authenticated |
| Tags | cors, headers, owasp |
Sends a request with an attacker-controlled Origin header and checks whether the server reflects it back in Access-Control-Allow-Origin or uses a wildcard (*), which may allow cross-origin data theft.
RB-INFRA-008 — Insecure cookie flags¶
| Severidad | Medium |
| Modos | passive, safe-active, authenticated |
| Tags | cookies, session, hardening, owasp |
Checks if cookies returned by the server lack the Secure, HttpOnly, or SameSite attributes, which protect against session hijacking and CSRF attacks.
RB-INFRA-009 — HTTP to HTTPS redirect missing¶
| Severidad | Medium |
| Modos | passive, safe-active, authenticated |
| Tags | tls, redirect, hardening |
Checks if the site serves content over plain HTTP (port 80) without redirecting to HTTPS, allowing man-in-the-middle attacks.
RB-INFRA-010 — Exposed phpinfo() page¶
| Severidad | High |
| Modos | passive, safe-active, authenticated |
| Tags | php, information-disclosure, hardening |
Checks for publicly accessible phpinfo() pages that disclose PHP version, modules, environment variables, and server configuration.
RB-INFRA-011 — Sensitive paths in robots.txt¶
| Severidad | Low |
| Modos | passive, safe-active, authenticated |
| Tags | robots, information-disclosure, reconnaissance |
Checks if robots.txt discloses sensitive paths such as admin panels, backup directories, configuration files, or staging environments.
RB-INFRA-012 — X-Powered-By header disclosure¶
| Severidad | Low |
| Modos | passive, safe-active, authenticated |
| Tags | headers, information-disclosure, hardening |
Checks if the X-Powered-By header is present, leaking technology stack and version information (e.g. PHP/8.1.2, Express, ASP.NET).
RB-INFRA-013 — Clickjacking — missing frame protections¶
| Severidad | Medium |
| Modos | passive, safe-active, authenticated |
| Tags | clickjacking, headers, owasp |
Checks if the site can be embedded in an iframe by verifying that neither X-Frame-Options nor CSP frame-ancestors directive is set.
RB-INFRA-014 — Open redirect¶
| Severidad | Medium |
| Modos | safe-active, authenticated |
| Tags | redirect, owasp, phishing |
Checks common URL parameters for open redirect vulnerabilities by injecting an external URL and observing if the server issues a redirect to it.
Magento 1 (12 checks)¶
RB-M1-001 — Magento Connect downloader exposed¶
| Severidad | Critical |
| Modos | passive, safe-active, authenticated |
| Tags | admin, rce, legacy |
Checks if the /downloader/ path is accessible. Allows remote module installation and is a common attack vector on Magento 1.
RB-M1-002 — Magento 1 admin panel exposed¶
| Severidad | High |
| Modos | passive, safe-active, authenticated |
| Tags | admin, hardening, access-control, legacy |
Checks if the Magento 1 admin panel is accessible at default or common paths without IP restriction.
RB-M1-003 — Magento 1 local.xml exposed¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | config, credentials, hardening, legacy |
Checks if /app/etc/local.xml is publicly accessible. This file contains database credentials, the encryption key, and other sensitive configuration.
RB-M1-004 — Magento 1 skin/adminhtml exposed¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | fingerprint, admin, hardening, legacy |
Checks if /skin/adminhtml/ is publicly accessible. Confirms the target runs Magento 1 and may leak admin theme information.
RB-M1-005 — Magento 1 API endpoint exposed¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | api, hardening, access-control, legacy |
Checks if /api/xmlrpc or /api/v2_soap is publicly accessible. An exposed SOAP/XML-RPC API may allow enumeration or exploitation of API methods.
RB-M1-006 — Magento 1 RSS feed data leak¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | data-leak, rss, hardening, legacy |
Checks if /rss/catalog/notifystock or /rss/order/new is publicly accessible. These feeds can leak order details and stock notification data.
RB-M1-007 — Magento 1 install wizard accessible¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | install, rce, hardening, legacy |
Checks if /install.php or /install/ is accessible. An exposed installation wizard allows an attacker to reconfigure or reinstall the store.
RB-M1-008 — phpinfo file exposed¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | info-disclosure, php, hardening, legacy |
Checks if /phpinfo.php, /info.php, or /test.php is accessible. These files expose PHP configuration, loaded modules, and environment variables.
RB-M1-009 — Magento 1 backup files exposed¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | backup, data-leak, hardening, legacy |
Checks Magento 1-specific backup paths: /var/backups/, /var/export/, and /media/backup/. Exposed backups may contain database dumps or sensitive export data.
RB-M1-010 — Magento 1 debug logs exposed¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | info-disclosure, logs, hardening, legacy |
Checks if /var/log/system.log or /var/log/exception.log is publicly accessible. These logs may reveal stack traces, file paths, database queries, and other sensitive information.
RB-M1-011 — Magento 1 directory listing enabled¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | info-disclosure, hardening, legacy |
Checks if /js/, /media/, or /var/ have directory listing enabled. Allows attackers to enumerate files, discover hidden resources, and map the application structure.
RB-M1-012 — Magento 1 version disclosure¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | fingerprint, info-disclosure, hardening, legacy |
Checks /js/mage/cookies.js, /RELEASE_NOTES.txt, and /LICENSE.txt for version fingerprinting. Allows attackers to identify the exact Magento version and target known vulnerabilities.
Magento 2 / Adobe Commerce (15 checks)¶
RB-M2-001 — Admin panel exposed¶
| Severidad | High |
| Modos | passive, safe-active, authenticated |
| Tags | admin, hardening, access-control |
Checks if the Magento 2 admin panel is publicly accessible at common paths without IP restriction or additional authentication.
RB-M2-002 — Magento version publicly exposed¶
| Severidad | Medium |
| Modos | passive, safe-active, authenticated |
| Tags | version, information-disclosure |
Checks if the Magento version is disclosed via the /magento_version endpoint, generator meta tag, or other public signals.
RB-M2-003 — REST/GraphQL API publicly accessible¶
| Severidad | High |
| Modos | passive, safe-active, authenticated |
| Tags | api, graphql, rest, information-disclosure |
Checks if Magento 2 REST and GraphQL APIs are accessible without authentication, potentially leaking store data.
RB-M2-004 — Cron endpoint exposed¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | cron, hardening, access-control |
Checks if /cron.php is publicly accessible, which could allow unauthenticated users to trigger scheduled tasks or leak internal info.
RB-M2-005 — Setup wizard accessible¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | setup, hardening, access-control |
Checks if the Magento 2 setup wizard at /setup/ is publicly accessible, which could allow attackers to reconfigure the store.
RB-M2-006 — Debug/developer mode enabled¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | debug, hardening, information-disclosure |
Detects if Magento 2 is running in developer or debug mode by inspecting response headers (X-Magento-Debug, MAGE_MODE) and error page signatures.
RB-M2-007 — env.php leaked¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | credentials, hardening, information-disclosure |
Checks if /app/etc/env.php is publicly accessible, which would leak database credentials, encryption keys, and other secrets.
RB-M2-008 — GraphQL introspection enabled¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | graphql, api, information-disclosure |
Checks if GraphQL introspection is enabled by sending an introspection query, which reveals the entire API schema to attackers.
RB-M2-009 — Default admin URL patterns¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | admin, hardening, access-control |
Checks if /admin responds and tests common custom admin path patterns that may be revealed via redirect behavior.
RB-M2-010 — Swagger/OpenAPI docs exposed¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | api, swagger, information-disclosure |
Checks if /rest/default/schema (Swagger/OpenAPI documentation) is publicly accessible, revealing all available API endpoints.
RB-M2-011 — Customer API leaks data without auth¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | api, customers, information-disclosure, access-control |
Checks if /rest/V1/customers/search returns customer data without authentication, indicating a misconfigured API ACL.
RB-M2-012 — phpinfo exposed¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | phpinfo, hardening, information-disclosure |
Checks if phpinfo.php or info.php is publicly accessible, leaking server configuration, PHP version, and environment details.
RB-M2-013 — Media directory listing enabled¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | media, directory-listing, hardening |
Checks if /media/.htaccess or /media/catalog/ is listable, indicating directory listing is enabled in the media folder.
RB-M2-014 — Sitemap leaks sensitive URLs¶
| Severidad | Low |
| Modos | passive, safe-active |
| Tags | sitemap, information-disclosure, seo |
Checks if sitemap.xml is accessible and contains admin, staging, or other sensitive URLs that should not be indexed.
RB-M2-015 — CORS misconfiguration¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | cors, headers, access-control |
Checks if CORS headers allow any origin, which could enable cross-site data theft from authenticated sessions.
PrestaShop (12 checks)¶
RB-PS-001 — PrestaShop admin panel exposed¶
| Severidad | High |
| Modos | passive, safe-active, authenticated |
| Tags | admin, hardening, access-control |
Checks if the PrestaShop back office is accessible at default or predictable paths.
RB-PS-002 — Known vulnerable modules exposed¶
| Severidad | High |
| Modos | passive, safe-active, authenticated |
| Tags | modules, cve, supply-chain |
Probes for PrestaShop modules with known public vulnerabilities by checking if their endpoints or assets are accessible.
RB-PS-003 — PrestaShop debug mode enabled¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | debug, hardening, information-disclosure |
Checks if PS_MODE_DEV is active by looking for debug toolbar, detailed error messages, or PrestaShop debug indicators in HTML responses and headers.
RB-PS-004 — phpinfo file exposed¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | phpinfo, information-disclosure, hardening |
Checks if phpinfo(), info.php, or test.php files are publicly accessible, leaking server configuration details.
RB-PS-005 — Configuration file accessible¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | config, credentials, information-disclosure |
Checks if PrestaShop configuration files such as config/settings.inc.php or app/config/parameters.php are publicly accessible, potentially leaking database credentials and secret keys.
RB-PS-006 — Installation directory present¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | install, hardening, access-control |
Checks if the /install/ or /install-dev/ directory is still present, which may allow reinstallation or leak internal paths.
RB-PS-007 — Directory listing enabled¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | directory-listing, hardening, information-disclosure |
Checks if common PrestaShop directories such as /modules/, /themes/, /upload/, /download/, and /img/ have directory listing enabled, exposing internal file structure.
RB-PS-008 — Autoupgrade module exposed¶
| Severidad | Medium |
| Modos | passive, safe-active |
| Tags | modules, hardening, information-disclosure |
Checks if /modules/autoupgrade/ is publicly accessible, which can reveal upgrade state, version info, and internal paths.
RB-PS-009 — Backup files accessible¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | backup, credentials, information-disclosure |
Checks for PrestaShop-specific backup paths such as /backup/, /backups/, and /config/settings.old.php that may expose database dumps or configuration data.
RB-PS-010 — PrestaShop webservice API accessible¶
| Severidad | High |
| Modos | passive, safe-active |
| Tags | api, access-control, information-disclosure |
Checks if the /api/ endpoint (PrestaShop webservice) is accessible without authentication, potentially exposing store data.
RB-PS-011 — Documentation files exposed¶
| Severidad | Low |
| Modos | passive, safe-active |
| Tags | documentation, version-disclosure, information-disclosure |
Checks if /docs/, /README.md, /CHANGELOG.txt, or /LICENSES are publicly accessible, which can disclose the exact PrestaShop version and internal details.
RB-PS-012 — Suspicious external JS on checkout pages¶
| Severidad | Critical |
| Modos | passive, safe-active |
| Tags | skimmer, magecart, checkout, javascript |
Fetches cart and order pages and inspects them for unexpected external JavaScript sources that may indicate a payment skimmer or Magecart-style injection.