detect deprecated XSS Protection headers

misconfiguration/xss-deprecated-header.yaml

@@ -0,0 +1,37 @@
+id: xss-deprecated-header-detect
+
+info:
+  name: Detect Deprecated XSS Protection Header
+  author: joshlarsen
+  severity: low
+  description: Setting the XSS-Protection header is deprecated by most browsers. Setting the header to anything other than `0` can actually introduce an XSS vulnerability.
+  reference:
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+    - https://owasp.org/www-project-secure-headers/#x-xss-protection
+  tags: xss,misconfig
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        part: header
+        regex:
+          - "(?i)x-xss-protection: 0"
+        negative: true
+
+      - type: regex
+        part: header
+        regex:
+          - "(?i)x-xss-protection: 1+"
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - x_xss_protection
+