Add curated checks for exposed credential files and Spring Actuator

Two read-only premium checks drawn from watching how AI pentest agents probe a
site.  Both only report when the response carries a real marker, never on a
bare 200, so they do not add false positives.

Exposed credential or private key file: tries the well known paths for AWS,
Google Cloud, Docker and s3cmd credential files and for SSH and TLS private
keys, and reports one only when the body actually holds a credential marker,
told apart from the site's not found page by a control.  A leaked key is signed
in with, no guessing, which is how several large breaches began.

Spring Boot Actuator exposed: tries the actuator paths and reports when the
answer is an actuator payload, the env or configprops configuration that
carries database passwords and API keys, the index that advertises heapdump, or
the bean list.  An open actuator hands an outsider the service's secrets.

Author: hackrange

app/core/dast_checks/curated/misconfiguration-cloud-credentials-file-exposed.json

@@ -0,0 +1,42 @@
+{
+  "id": "misconfiguration-cloud-credentials-file-exposed",
+  "class": "misconfiguration",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "A cloud credential or private key file is exposed",
+  "summary": "A file that holds cloud credentials or a private key is being served to anyone. An outsider who reads an AWS, Google Cloud, Docker or s3cmd credential file, or an SSH or TLS private key, can sign in to the account or service it belongs to with no guessing, which is how several large breaches began. This check only reports the file when its body actually carries a credential marker, so a plain not-found page is never a finding.",
+  "needs": [],
+  "candidate_paths": [
+    "/.aws/credentials",
+    "/.aws/credentials.bak",
+    "/.aws/config",
+    "/.config/gcloud/application_default_credentials.json",
+    "/application_default_credentials.json",
+    "/service-account.json",
+    "/gcp-credentials.json",
+    "/google-credentials.json",
+    "/.docker/config.json",
+    "/.s3cfg",
+    "/.boto",
+    "/.ssh/id_rsa",
+    "/.ssh/id_ed25519",
+    "/secrets.json",
+    "/credentials.json"
+  ],
+  "probe": [
+    { "request": { "method": "GET", "path": "{route}" } }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and a credential file is told apart from a soft 404 or a catch-all page.",
+    "differential": "status == 200 and (body_contains(\"aws_access_key_id\") or body_contains(\"aws_secret_access_key\") or (body_contains(\"\\\"private_key\\\"\") and body_contains(\"\\\"client_email\\\"\")) or (body_contains(\"\\\"auths\\\"\") and body_contains(\"\\\"auth\\\"\")) or (body_contains(\"access_key\") and body_contains(\"secret_key\")) or body_contains(\"PRIVATE KEY-----\")) and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/.aws/credentials' (and the other candidate paths this check tried) and read the body.  An AWS file shows aws_access_key_id and aws_secret_access_key; a Google service account shows \"private_key\" and \"client_email\"; a Docker config shows \"auths\" with an \"auth\" token; an s3cmd or boto file shows access_key and secret_key; an SSH or TLS key shows a PRIVATE KEY----- block.  If any returns the secret, treat it as live and rotate it.",
+  "remediate": "Remove the file from the web root and from anything the server will serve, then rotate every credential it exposed, since it must be assumed to have been read.  Serve application code from a directory that does not include dotfiles or deployment artifacts, and add a rule that denies requests for credential and key files.  Keep secrets in a secret manager or environment, never in a file under the document root.",
+  "references": [],
+  "mappings": {
+    "cwe": "CWE-798",
+    "owasp": "A05:2021"
+  },
+  "rulesets": ["secret-files"]
+}

app/core/dast_checks/curated/misconfiguration-spring-actuator-exposed.json

@@ -0,0 +1,34 @@
+{
+  "id": "misconfiguration-spring-actuator-exposed",
+  "class": "misconfiguration",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "Spring Boot Actuator is exposed, leaking configuration and secrets",
+  "summary": "A Spring Boot Actuator endpoint is answering without a login. The env and configprops endpoints print the application's configuration, which usually includes database passwords, API keys and other secrets, and the heapdump endpoint hands over a full memory dump that carries every secret the process holds. An outsider who reaches these reads the credentials and can often move on to take over the service. This check only reports it when the response is an actuator payload, not a plain page.",
+  "needs": [],
+  "candidate_paths": [
+    "/actuator",
+    "/actuator/env",
+    "/actuator/configprops",
+    "/actuator/beans",
+    "/actuator/mappings",
+    "/api/actuator",
+    "/api/actuator/env"
+  ],
+  "probe": [
+    { "request": { "method": "GET", "path": "{route}" } }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and an actuator payload is told apart from a soft 404 or a catch-all page.",
+    "differential": "status == 200 and ((body_contains(\"\\\"propertySources\\\"\") and body_contains(\"\\\"activeProfiles\\\"\")) or (body_contains(\"\\\"_links\\\"\") and body_contains(\"\\\"heapdump\\\"\")) or (body_contains(\"\\\"_links\\\"\") and body_contains(\"\\\"self\\\"\") and body_contains(\"\\\"env\\\"\")) or (body_contains(\"\\\"contexts\\\"\") and body_contains(\"\\\"beans\\\"\"))) and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/actuator' and read the JSON: an exposed actuator answers with a \"_links\" list that names env, configprops, beans and often heapdump.  Then curl -sk 'https://host/actuator/env' for the configuration (look for \"propertySources\" and \"activeProfiles\"), where database passwords and API keys usually sit.  If 'https://host/actuator/heapdump' downloads a file, the whole process memory, with every secret in it, is readable.",
+  "remediate": "Do not expose actuator to the internet.  Set management.endpoints.web.exposure.include to only the endpoints you need (health and info at most), put the management port behind the firewall or on a separate internal interface, and require authentication on the actuator path.  Rotate any secret that env, configprops or heapdump could have shown, since they must be assumed read.",
+  "references": [],
+  "mappings": {
+    "cwe": "CWE-200",
+    "owasp": "A05:2021"
+  },
+  "rulesets": ["spring-boot"]
+}