nuclei-templates/http/osint/phishing/steam-phish.yaml

37 lines
914 B
YAML

id: steam-phish
info:
name: steam phishing Detection
author: rxerium
severity: info
description: |
A steam phishing website was detected
reference:
- https://steampowered.com
tags: phishing,steam,osint
http:
- method: GET
path:
- "{{BaseURL}}"
host-redirects: true
max-redirects: 2
matchers-condition: and
matchers:
- type: word
words:
- 'Welcome to Steam'
- 'Steam is the ultimate destination for playing, discussing, and creating games.'
condition: and
- type: status
status:
- 200
- type: dsl
dsl:
- '!contains(host,"steampowered.com")'
# digest: 4b0a00483046022100c9cf7138616432481ce0e65481f2d94bec809aa74cb2d3135550eb2d537b92bd022100da10fbc4cfc93d9d9d823698e025d48418e6abcddb76b3cee5864ae9e9dafed0:922c64590222798bb761d5b6d8e72950