From 5d508389e83fb273cdcfdb6c06a74cd5d6925713 Mon Sep 17 00:00:00 2001 From: Prince Chaddha Date: Sun, 22 Oct 2023 16:16:22 +0530 Subject: [PATCH] updated regex --- http/exposures/files/office-documents-links.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/http/exposures/files/office-documents-links.yaml b/http/exposures/files/office-documents-links.yaml index af6dd61ce9..ec63161a14 100644 --- a/http/exposures/files/office-documents-links.yaml +++ b/http/exposures/files/office-documents-links.yaml @@ -1,11 +1,11 @@ id: office-documents-links info: - name: Office Documents links extractor + name: Office Documents Links Extractor author: Herry severity: info description: Extract Office Documents links from web page body - tags: docuemnts,config,exposure,files,office + tags: documents,config,exposure,files,office requests: - method: GET @@ -16,7 +16,7 @@ requests: - type: regex part: body regex: - - '(?:https?|ftp)://\S+\.(xlsx?|csv|pptx?|msg|rtf|pub|rtf|mdb|odp|ods|odt|doc|xls)' + - '(?i)(?:https?|ftp)://[^\s?#]+\.((xlsx?|csv|pptx?|msg|rtf|pub|rtf|mdb|odp|ods|odt|doc|xls))([#?].*)?' extractors: - type: regex