nuclei-templates/dns/ptr-fingerprint.yaml

31 lines
554 B
YAML
Raw Normal View History

id: ptr-fingerprint
info:
name: PTR Detected
author: pdteam
severity: info
description: A PTR record was detected. A PTR record refers to the domain name.
tags: dns,ptr
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cve-id:
cwe-id: CWE-200
dns:
- name: "{{FQDN}}"
type: PTR
matchers:
- type: word
words:
- "IN\tPTR"
extractors:
- type: regex
group: 1
regex:
- "IN\tPTR\t(.+)"
# Enhanced by mp on 2022/03/14