nuclei-templates/http/osint/phishing/roboform-phish.yaml

38 lines
1.0 KiB
YAML

id: roboform-phish
info:
name: roboform phishing Detection
author: rxerium
severity: info
description: |
A roboform phishing website was detected
reference:
- https://roboform.com
metadata:
max-request: 1
tags: phishing,roboform,osint
http:
- method: GET
path:
- "{{BaseURL}}"
host-redirects: true
max-redirects: 2
matchers-condition: and
matchers:
- type: word
words:
- 'Best Password Manager: No more writing down passwords'
- 'Multi-platform secure solution to simplify your online experience. One click login on Chrome, Firefox, Safari, IE, Opera, Edge, Windows, Mac, iOS, Android.'
- 'roboform'
condition: and
- type: status
status:
- 200
- type: dsl
dsl:
- '!contains(host,"roboform.com")'
# digest: 4a0a004730450221008af0f7baae8a5d1ce04e52556979e1d9067e7764fd26d452e489b5870624018d022042c95bb5df55d74566f7558027ef7976d0a18671d4322edf922a64fa1e74fc1f:922c64590222798bb761d5b6d8e72950