Files
nuclei-templates/dns/ptr-fingerprint.yaml
2024-12-01 13:57:55 +00:00

28 lines
680 B
YAML

id: ptr-fingerprint
info:
name: PTR Detected
author: pdteam
severity: info
description: A PTR record was detected. A PTR record refers to the domain name.
classification:
cwe-id: CWE-200
metadata:
max-request: 1
tags: dns,ptr
dns:
- name: "{{FQDN}}"
type: PTR
matchers:
- type: regex
part: answer
regex:
- "IN\tPTR\\t(.+)$"
extractors:
- type: regex
group: 1
regex:
- "IN\tPTR\t(.+)"
# digest: 4a0a00473045022027a6c832dc230b202a1b5bea244368b9dd52bce8a3093ea68bde4c2d1f7aa1b1022100840ac44bbb98cf511bab413bf6c96239fba295f31e274999ad0059e51d9e9cfc:922c64590222798bb761d5b6d8e72950