diff --git a/http/miscellaneous/detect-maxforwards-headers.yaml b/http/miscellaneous/detect-maxforwards-headers.yaml new file mode 100644 index 0000000000..319e7d0e6e --- /dev/null +++ b/http/miscellaneous/detect-maxforwards-headers.yaml @@ -0,0 +1,33 @@ +id: detect-maxforwards-headers + +info: + name: Max-Forwards header - Detection + author: righettod + severity: info + description: Max-Forwards response header is specified. + reference: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Max-Forwards + - https://http.dev/max-forwards + - https://twitter.com/irsdl/status/1337299267652825088 + metadata: + verified: 'true' + max-request: 1 + shodan-query: "Max-Forwards:" + fofa-query: header="max-forwards" + tags: miscellaneous,misc + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: dsl + dsl: + - 'contains(to_lower(header), "max-forwards:")' + + extractors: + - type: regex + part: header + regex: + - '(?i)max-forwards:\s+([0-9]+)' \ No newline at end of file