fix(modules): drop the zabbix response content-type matcher

application/json-rpc is a request precondition, not a response type.
ui/api_jsonrpc.php accepts application/json-rpc, application/json or
application/jsonrequest and answers 412 otherwise, then always sets
`header('Content-Type: application/json')`. matchers are and'd, so
requiring json-rpc back meant the module never fired against a live
instance.

the test served the mock as application/json-rpc and asserted the real
application/json case produced no findings, so it locked the dead
behaviour in. it now runs the real shape and keeps json-rpc as a second
firing case for proxies that echo the request type.

status 200 plus the jsonrpc-2.0 dotted-result regex is already specific to
apiinfo.version; a json-rpc error body stays silent.

Author: TBX3D

internal/modules/zabbix_api_exposure_test.go

@@ -1,3 +1,15 @@
+/*
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+:                                                                               :
+:   █▀ █ █▀▀   ·   Blazing-fast pentesting suite                                :
+:   ▄█ █ █▀    ·   BSD 3-Clause License                                         :
+:                                                                               :
+:   (c) 2022-2026 vmfunc, xyzeva,                                               :
+:                 lunchcat alumni & contributors                                :
+:                                                                               :
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+*/
+
 package modules_test
 
 import (
@@ -10,10 +22,10 @@ import (
 	"github.com/vmfunc/sif/internal/modules"
 )
 
-// zabbix-api-exposure fires only when the target answers apiinfo.version with a
-// json-rpc content-type AND a dotted-version result. A foreign service that
-// speaks json-rpc but returns a non-version result, or serves the version under
-// the wrong content-type, must stay silent.
+// zabbix-api-exposure fires on a target that answers apiinfo.version with a
+// dotted-version json-rpc result. the discriminator is the result shape, not the
+// content-type; the module explains why. a service that speaks json-rpc but
+// returns something other than a version must stay silent.
 func TestZabbixAPIExposureModule(t *testing.T) {
 	const mod = "../../modules/recon/zabbix-api-exposure.yaml"
 	def, err := modules.ParseYAMLModule(mod)
@@ -36,7 +48,8 @@ func TestZabbixAPIExposureModule(t *testing.T) {
 		return res
 	}
 
-	fire := run("application/json-rpc", `{"jsonrpc":"2.0","result":"7.0.5","id":1}`)
+	// what a live zabbix actually puts on the wire.
+	fire := run("application/json", `{"jsonrpc":"2.0","result":"7.0.5","id":1}`)
 	if len(fire.Findings) == 0 {
 		t.Error("fire-on-real failed: exposed apiinfo.version not detected")
 	}
@@ -50,11 +63,22 @@ func TestZabbixAPIExposureModule(t *testing.T) {
 		t.Errorf("version extraction: got %q, want 7.0.5", version)
 	}
 
-	if res := run("application/json-rpc", `{"jsonrpc":"2.0","result":"pong","id":1}`); len(res.Findings) != 0 {
+	// key order is not guaranteed; a reordered body must still match.
+	if res := run("application/json", `{"id":1,"jsonrpc":"2.0","result":"7.0.5"}`); len(res.Findings) == 0 {
+		t.Error("fire-on-reordered-keys failed: exposed apiinfo.version not detected")
+	}
+
+	// older deployments and proxies that echo the request type back still fire.
+	if res := run("application/json-rpc", `{"jsonrpc":"2.0","result":"7.0.5","id":1}`); len(res.Findings) == 0 {
+		t.Error("fire-on-json-rpc-content-type failed: exposed apiinfo.version not detected")
+	}
+
+	if res := run("application/json", `{"jsonrpc":"2.0","result":"pong","id":1}`); len(res.Findings) != 0 {
 		t.Errorf("silent-on-foreign-jsonrpc failed: %d findings for a non-version result", len(res.Findings))
 	}
 
-	if res := run("application/json", `{"jsonrpc":"2.0","result":"7.0.5","id":1}`); len(res.Findings) != 0 {
-		t.Errorf("silent-on-wrong-content-type failed: %d findings", len(res.Findings))
+	// a json-rpc error (auth required, method not found) is not a version leak.
+	if res := run("application/json", `{"jsonrpc":"2.0","error":{"code":-32602,"message":"Invalid params."},"id":1}`); len(res.Findings) != 0 {
+		t.Errorf("silent-on-jsonrpc-error failed: %d findings", len(res.Findings))
 	}
 }

modules/recon/zabbix-api-exposure.yaml

@@ -14,25 +14,31 @@ http:
     - "{{BaseURL}}/api_jsonrpc.php"
     - "{{BaseURL}}/zabbix/api_jsonrpc.php"
 
+  # api_jsonrpc.php answers 412 Precondition Failed unless the request carries
+  # one of application/json-rpc, application/json or application/jsonrequest.
   headers:
     Content-Type: application/json-rpc
 
   body: '{"jsonrpc":"2.0","method":"apiinfo.version","params":{},"id":1}'
 
+  # no response content-type matcher: that type is a request precondition, and
+  # zabbix always answers `header('Content-Type: application/json')`. requiring
+  # application/json-rpc back never matched a live instance. the jsonrpc-2.0 plus
+  # dotted-result shape below is specific to apiinfo.version on its own.
   matchers:
     - type: status
       status:
         - 200
 
-    - type: word
-      part: header
-      words:
-        - "application/json-rpc"
-
+    # two and'd patterns rather than one: json object key order is not
+    # guaranteed, so a serializer that emits id before jsonrpc would miss a
+    # single pattern that requires them adjacent.
     - type: regex
       part: body
+      condition: and
       regex:
-        - '"jsonrpc"\s*:\s*"2\.0"\s*,\s*"result"\s*:\s*"[0-9]+\.[0-9]+(\.[0-9]+)?"'
+        - '"jsonrpc"\s*:\s*"2\.0"'
+        - '"result"\s*:\s*"[0-9]+\.[0-9]+(\.[0-9]+)?"'
 
   extractors:
     - type: regex