id: crypto-address-detect

info:
  name: Exposed Cryptocurrency Wallet Address
  author: rxerium
  severity: info
  description: |
    Detected Bitcoin, Monero, Ethereum, or XRP wallet addresses were identified in webpage content.
  reference:
    - https://bitcoin.org/
    - https://xrpl.org/
    - https://www.getmonero.org/
    - https://en.wikipedia.org/wiki/Ethereum
  metadata:
    max-request: 1
    verified: true
  tags: crypto,bitcoin,monero,ethereum,xrp,ripple,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - name: bitcoin-address
        type: dsl
        dsl:
          - 'regex("([13][a-km-zA-HJ-NP-Z1-9]{25,34})", body)'
          - 'status_code == 200'
        condition: and

      - name: monero-address
        type: dsl
        dsl:
          - 'regex("(4[0-9AB][1-9A-HJ-NP-Za-km-z]{93})", body)'
          - 'status_code == 200'
        condition: and

      - name: ethereum-address
        type: dsl
        dsl:
          - 'regex("(0x[a-fA-F0-9]{40})", body)'
          - 'status_code == 200'
        condition: and

      - name: xrp-address
        type: dsl
        dsl:
          - 'regex("(r[0-9a-zA-Z]{24,34})", body)'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022100a9dbf20fc94b043ea823958329a487903d28489ef7a5a6c8005aa9cf3cf97aaf02205c680ad7124e0ac83d446031fe5c238a23d60ef0a7914141fc2012603eef8108:922c64590222798bb761d5b6d8e72950