misconfig-mapper is a template-driven Go CLI from Intigriti that enumerates third-party services and checks them for common security misconfigurations during authorized bug bounty and assessment work.
| Tool | intigriti/misconfig-mapper — template-based Go CLI for detecting security misconfigurations in popular third-party services and SaaS platforms |
| Category | Reconnaissance and misconfiguration scanning for third-party/SaaS services |
| Primary Use | Enumerating instances of third-party services used by an organization via -target and -service, then checking them against fingerprint templates in services.json |
| Safe Use | Intended for authorized penetration tests, bug bounty programs with defined scope, and internal audits of your own organization's SaaS footprint |
| Telemetry Note | The tool issues HTTP requests with a default -timeout of 7000ms and follows up to -max-redirects redirects, generating distinctive permutation-based DNS/HTTP lookups ({TARGET}-app, {TARGET}-eu) that appear in third-party provider and CDN logs |
misconfig-mapper is Intigriti's open-source contribution to a problem every external assessor eventually hits: an organization's real attack surface is rarely limited to infrastructure it owns. SaaS subscriptions, third-party collaboration platforms, and forgotten pilots often carry the company's name in a subdomain or tenant path, and any one of them can be misconfigured in an immediately exploitable way — open signups, exposed dashboards, default permissions. The README frames the tool precisely around this: find, detect, and resolve common security misconfigurations in popular services, technologies, and SaaS-based solutions that your targets use. It is written in Go, MIT-licensed, and sits at roughly 910 stars, which is respectable traction for a niche utility.
Architecturally, the tool is a templating engine wrapped around an HTTP client. Every check it performs is defined in a services.json file, where each entry describes one service plus one misconfiguration check. The templates folder defaults to ./templates, and you can point elsewhere with -templates. This design choice matters more than it first appears: the binary contains no hardcoded intelligence about what a misconfigured drupal or Atlassian Jira instance looks like — all of that lives in user-editable, community-extensible JSON. The -update-templates flag pulls the latest templates from GitHub, which keeps detection logic fresh without recompiling.
The discovery workflow starts from a company keyword rather than a hostname. You pass -target "yourcompanyname" and the tool generates permutations — yourcompanyname-app, yourcompanyname-eu, and so on — substituting them into a {TARGET} variable embedded in each template's baseURL or path. The -permutations flag controls this behavior and is enabled by default; if you instead have an actual domain, -as-domain treats the target directly, and the README is explicit that the two flags are mutually exclusive. This permutation approach mirrors how an attacker manually guesses tenant names, which is exactly why defenders should understand it.
Each template is split into request and response halves. The request side defines method, baseURL, path, optional headers as an object array, and a body that can be null. The response side is where the signal quality lives: a statusCode integer narrows matches, detectionFingerprints (a string array supporting regex) confirm that the service simply exists for the target, and a separate fingerprints array confirms the misconfiguration itself. Splitting presence-detection from misconfiguration-confirmation is a deliberate design — it enables the -skip-misconfiguration-checks mode, where you enumerate a target's third-party footprint without running the riskier follow-up checks.
That enumeration-only mode is arguably the most defensible feature in the tool. Running ./misconfig-mapper -target "yourcompanyname" -service "*" -skip-misconfiguration-checks true produces an inventory of third-party services associated with the brand — essentially attack-surface mapping — while deferring any vulnerability assertions. For blue teams, that same command against your own organization is a cheap, recurring shadow-IT audit: every hit is a service someone in the company signed up for that security never reviewed.
Installation is standard Go fare. With Go 1.24 or later, go install github.com/intigriti/misconfig-mapper/cmd/misconfig-mapper@latest puts the binary on your PATH, or you can git clone and go build -o misconfig-mapper ./cmd/misconfig-mapper. One operational note from the README worth repeating: if you install from a prebuilt release rather than compiling, you must run -update-templates once, or the tool will have no services.json to work from and will silently do nothing useful.
The flag surface reveals careful operational tuning. -delay enforces a rate limit in milliseconds between requests — important because permutation scanning against a third-party provider hammers their infrastructure, not yours, and getting your egress IP blocked mid-engagement is a self-inflicted wound. -timeout defaults to 7000ms, -max-redirects caps redirect following at 5, -skip-ssl disables certificate verification (the README itself warns to exercise caution), and -headers lets you inject request headers like a custom User-Agent, separated by double semicolons. -output-json structures results for downstream tooling, and -verbose offers three levels, from silent-and-vulnerabilities-only up to full logging.
Service selection is flexible: -service "*" sweeps everything, -service "0,1" combines IDs, and -service "drupal" accepts names as well as numeric IDs. -list-services (aliased as -list-templates) dumps the loaded catalog with IDs, which is the first thing to run after any template update since IDs shift as the community appends entries. Shell completion scripts for Bash and Zsh are documented in full, including the compinit initialization step for OhMyZsh users — a small quality-of-life touch that suggests real operator input went into the project.
From a tradecraft perspective, misconfig-mapper occupies the same shelf as tools that enumerate exposed devops panels or check tenant takeover conditions, but its extensibility model is its differentiator. The template schema includes reproductionSteps and references arrays, so every finding the CLI reports comes bundled with documentation explaining what the misconfiguration means and how to verify it manually. For a report-writing consultant, that metadata pipeline — scan, detect, cite — compresses hours of boilerplate into minutes. It also means template authors are incentivized to document responsibly: a check without references ships incomplete.
The false-positive discipline is worth noting for anyone planning to extend it. The README repeatedly advises strict regex patterns in both fingerprint arrays to minimize false positives, and the statusCode match adds a second validation layer. This is sensible — third-party SaaS responses change constantly, and a loose keyword like a product name in a login page would fire on every tenant of a provider, not just your target's. Anyone writing custom templates should treat fingerprint precision as the primary engineering effort.
Defensively, the tool's traffic pattern is distinctive and observable. Permutation-based lookups across {TARGET}-app and {TARGET}-eu style hostnames generate correlated DNS queries and HTTP requests that land in SaaS provider and CDN logs, and the default User-Agent is overridable but known. Organizations worried about this class of enumeration get more value from the tool pointed inward: run it against your own brand quarterly, treat every enumerated service as an asset to inventory, and fix the misconfigurations it flags before an authorized tester — or someone less authorized — finds them first.
As with every reconnaissance tool covered here, the governing constraint is scope. Permutation scanning against a company name probes third-party infrastructure you almost certainly do not own, so the legitimate contexts are contracts, bug bounty programs with permissive scope language, and your own organization's attack surface. Within those boundaries, misconfig-mapper is a well-engineered, well-documented example of how template-driven automation turns a tedious manual discipline into a repeatable check.
intigriti/misconfig-mapper.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.