id: assetlinks-detect

info:
  name: Android Asset Links Configuration - Detect
  author: rxerium
  severity: info
  description: |
    The .well-known/assetlinks.json file was found on the target server. This file is used by Android applications to establish verified app-to-web domain associations through the Digital Asset Links protocol.
  reference:
    - https://developer.android.com/training/app-links/verify-android-applinks
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"assetlinks.json"
  tags: misc,assetlinks,compliance,assetlinks,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/assetlinks.json"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'android_app')"
          - "contains(content_type, 'application/json')"
        condition: and
# digest: 4a0a0047304502210090e4c9b7c353747e374eb18969be7898710c1e19d8c68d0ea6e2ff9ff84bf70c022063c490a5746a0fdf4a250345bb22cadc3ba10bdc115ebf68298a3b8a52b024e4:922c64590222798bb761d5b6d8e72950