id: keybase-domain-owwnership-verification

info:
  name: Keybase Domain Ownership Verification
  author: rxerium
  severity: info
  description: |
    Detects presence of keybase.txt used to prove domain ownership via Keybase identity.
  reference:
    - https://book.keybase.io/account#proofs
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"keybase.txt"
  tags: keybase,identity,well-known,pgp,discovery,osint,misc

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/keybase.txt"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 && contains(body, 'https://keybase.io/')"

    extractors:
      - type: regex
        name: keybase-username
        part: body
        regex:
          - "([a-zA-Z0-9_-]+) \\(https://keybase.io/[a-zA-Z0-9_-]+\\)"

      - type: regex
        name: pgp-message
        part: body
        regex:
          - "-----BEGIN PGP MESSAGE-----[\\s\\S]+?-----END PGP MESSAGE-----"
# digest: 4a0a00473045022100f6a0580358cb30e020354dede500763b8d83d6d45517a0c9b0bf96e4942a929102200dd586364645434ea41a343174c02dc4c35a31e2d620b889fa5a597c2e3fd2f3:922c64590222798bb761d5b6d8e72950