VictoriaMetrics' vmagent exposes a /targets (human) and /api/v1/targets
(JSON) view of every scrape target it is configured against, with no
authentication by default. This leaks internal service inventory
(hostnames, ports, labels) and scrape health, which is useful recon data
for an attacker mapping an organization's internal infrastructure.
登录后查看神龙缓存的 POC 文件快照
登录查看