nuclei/pkg/tmplexec/flow/testcases/condition-flow-extractors.yaml

29 lines
420 B
YAML
Raw Permalink Normal View History

id: ghost-blog-detection
info:
name: Ghost blog detection
author: pdteam
severity: info
flow: dns() && http()
dns:
- name: "{{FQDN}}"
type: CNAME
extractors:
- type: dsl
name: cname
internal: true
dsl:
- cname
http:
- method: GET
path:
- "{{BaseURL}}?ref={{cname}}"
matchers:
- type: word
words:
- "ghost.io"