nuclei-templates/http/osint/phishing/slack-phish.yaml

35 lines
892 B
YAML
Raw Permalink Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

id: slack-phish
info:
name: slack phishing Detection
author: rxerium
severity: info
description: |
A slack phishing website was detected
reference:
- https://slack.com
metadata:
max-request: 1
tags: phishing,slack,osint
http:
- method: GET
path:
- "{{BaseURL}}"
host-redirects: true
max-redirects: 2
matchers-condition: and
matchers:
- type: word
words:
- 'Slack is a new way to communicate with your team. Its faster, better organised and more secure than email.'
- type: status
status:
- 200
- type: dsl
dsl:
- '!contains(host,"slack.com")'
# digest: 4a0a00473045022100c9f33426ccd1731ff05046e4dfa4a3227232fcab184961753e93bbaefbae0a0a0220696099603584c4d911478f0495079693c0ec69121bf30ddab72388c5955ad0b2:922c64590222798bb761d5b6d8e72950