Security Test: Private IP¶

Description¶

Default Severity: low

The issue here is that internal network addresses, which should remain hidden, are showing up in responses that might be seen publicly. When private IPs or hostnames from internal systems like EC2 appear outside their intended environment, attackers could use this information to learn about your network's structure and launch targeted attacks. Developers can inadvertently expose sensitive details through misconfigurations or overly verbose error messages, which leads to increased risks if the problem isn’t fixed promptly.

Configuration¶

Identifier: information_disclosure/private_ip

Examples¶

All configuration available:

checks:
  information_disclosure/private_ip:
    skip: false # default

Compliance and Standards¶