nuclei-templates/miscellaneous/security.txt.yaml

id: security-txt

info:
  name: Security.txt File
  author: bad5ect0r
  severity: info
  description: The website defines a security policy.
  tags: misc

requests:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/security.txt"
      - "{{BaseURL}}/security.txt"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Contact:"
        condition: and
      - type: dsl
        dsl:
          - "len(body) <= 1024 && len(body) > 0"
        condition: and
Detect security.txt file. Detect if a site supports responsible disclosure with a security.txt file: https://securitytxt.org/ 2020-05-08 11:06:57 +00:00			`id: security-txt`

			`info:`
			`name: Security.txt File`
			`author: bad5ect0r`
uniform severity update 2020-08-03 21:52:00 +00:00			`severity: info`
add few descriptions add few descriptions and references on /vulnerabilities/ templates. 2020-08-25 19:43:43 +00:00			`description: The website defines a security policy.`
Added more tags 2021-04-01 18:35:08 +00:00			`tags: misc`
Detect security.txt file. Detect if a site supports responsible disclosure with a security.txt file: https://securitytxt.org/ 2020-05-08 11:06:57 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}/.well-known/security.txt"`
Add top-level directory check for security.txt security.txt files can be placed under the top-level directory too. This commit adds a check for: https://example.com/security.txt 2020-06-01 12:25:40 +00:00			`- "{{BaseURL}}/security.txt"`
Fixed default condition OR to AND in false-positives 2020-07-08 11:38:57 +00:00			`matchers-condition: and`
Detect security.txt file. Detect if a site supports responsible disclosure with a security.txt file: https://securitytxt.org/ 2020-05-08 11:06:57 +00:00			`matchers:`
Add more strict rules for security.txt Previous one had a few false positives. This should narrow that down. 2020-05-08 11:41:26 +00:00			`- type: status`
			`status:`
			`- 200`
Detect security.txt file. Detect if a site supports responsible disclosure with a security.txt file: https://securitytxt.org/ 2020-05-08 11:06:57 +00:00			`- type: word`
			`words:`
			`- "Contact:"`
Add more strict rules for security.txt Previous one had a few false positives. This should narrow that down. 2020-05-08 11:41:26 +00:00			`condition: and`
			`- type: dsl`
			`dsl:`
Update syntax 2020-05-25 08:02:27 +00:00			`- "len(body) <= 1024 && len(body) > 0"`
Add more strict rules for security.txt Previous one had a few false positives. This should narrow that down. 2020-05-08 11:41:26 +00:00			`condition: and`