id: onion-website-supported

info:
  name: Onion Website Supported via Onion-Location Header
  author: rxerium
  severity: info
  description: |
    Identified websites that supported Tor network access through the Onion-Location HTTP response header, which pointed to a corresponding .onion service for enhanced privacy and anonymity.
  metadata:
    verified: true
    max-request: 1
  tags: misc,osint,tor,onion

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?i)onion-location:\s*https?://[a-z0-9]+\.onion'

    extractors:
      - type: regex
        part: header
        group: 1
        regex:
          - '(?i)onion-location:\s*(https?://[a-z0-9]+\.onion)'
# digest: 4b0a00483046022100b8c15185ef94f315720cd19bcdca2c698fdf6b861e79c96a9bb601e849d2213f022100ea5ae2ae60a4cb81c648b0cc2412556dc51bc41bb3a3cb5870d311690a4b43e2:922c64590222798bb761d5b6d8e72950