Merge pull request #8901 from projectdiscovery/princechaddha-patch-3

Delete http/misconfiguration/httponly-cookie-detect.yaml

http/misconfiguration/cookies-without-httponly.yaml

@@ -0,0 +1,42 @@
+id: cookies-without-httponly
+
+info:
+  name: Cookies without HttpOnly attribute - Detect
+  author: princechaddha,Mr.Bobo HP
+  severity: info
+  description: |
+    Checks whether cookies in the HTTP response contain the HttpOnly attribute. If the HttpOnly flag is set, it means that the cookie is HTTP-only
+  impact: |
+    Lack of HttpOnly flag on cookies increases the risk of client-side attacks, compromising user session security and data privacy.
+  remediation: |
+    Ensure that all cookies are set with the HttpOnly attribute to prevent client-side access.
+  reference:
+    - https://owasp.org/www-community/HttpOnly
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0
+  metadata:
+    verified: true
+    max-request: 1
+  tags: misconfig,http,cookie,generic
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    host-redirects: true
+    max-redirects: 2
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - 'Set-Cookie'
+
+      - type: word
+        part: header
+        words:
+          - "HttpOnly"
+        negative: true

http/misconfiguration/httponly-cookie-detect.yaml

@@ -1,34 +0,0 @@
-id: httponly-cookie-detect
-
-info:
-  name: HttpOnly Cookie - Detect
-  author: Mr. Bobo HP
-  severity: info
-  description: |
-    Checks whether cookies in the HTTP response contain the HttpOnly attribute. If the HttpOnly flag is set, it means that the cookie is HTTP-only
-  reference:
-    - https://stackoverflow.com/questions/4316539/how-do-i-test-httponly-cookie-flag
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
-    cvss-score: 0
-  metadata:
-    verified: true
-    max-request: 1
-  tags: misconfig,http,cookie,generic
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: header
-        words:
-          - Set-Cookie
-          - HttpOnly
-        condition: and
-        case-insensitive: true
-
-# digest: 490a0046304402207aea4f66841920dd854bfb78b8f8976dfce17e524b019c56457d0e8bd46fac0a0220298f5fa7b968b183c6e1192bf731eaaf267414e55014ad43627b9ccedfe87854:922c64590222798bb761d5b6d8e72950