nuclei-templates/misconfiguration/xss-deprecated-header.yaml

37 lines
907 B
YAML
Raw Normal View History

id: xss-deprecated-header-detect
info:
name: Detect Deprecated XSS Protection Header
author: joshlarsen
2022-05-17 08:06:53 +00:00
severity: info
description: Setting the XSS-Protection header is deprecated by most browsers. Setting the header to anything other than `0` can actually introduce an XSS vulnerability.
reference:
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
- https://owasp.org/www-project-secure-headers/#x-xss-protection
2022-05-17 08:06:53 +00:00
tags: xss,misconfig,generic
requests:
- method: GET
path:
- "{{BaseURL}}"
matchers-condition: and
matchers:
- type: regex
part: header
regex:
- "(?i)x-xss-protection: 0"
negative: true
- type: regex
part: header
regex:
- "(?i)x-xss-protection: 1+"
extractors:
- type: kval
part: header
kval:
2022-05-17 08:06:53 +00:00
- x_xss_protection