id: crypto-address-detect

info:
  name: Exposed Cryptocurrency Wallet Address
  author: rxerium
  severity: info
  description: |
    Detected Bitcoin, Monero, Ethereum, or XRP wallet addresses were identified in webpage content.
  reference:
    - https://bitcoin.org/
    - https://xrpl.org/
    - https://www.getmonero.org/
    - https://en.wikipedia.org/wiki/Ethereum
  metadata:
    max-request: 1
    verified: true
  tags: crypto,bitcoin,monero,ethereum,xrp,ripple,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - name: bitcoin-address
        type: dsl
        dsl:
          - 'regex("([13][a-km-zA-HJ-NP-Z1-9]{25,34})", body)'
          - 'status_code == 200'
        condition: and

      - name: monero-address
        type: dsl
        dsl:
          - 'regex("(4[0-9AB][1-9A-HJ-NP-Za-km-z]{93})", body)'
          - 'status_code == 200'
        condition: and

      - name: ethereum-address
        type: dsl
        dsl:
          - 'regex("(0x[a-fA-F0-9]{40})", body)'
          - 'status_code == 200'
        condition: and

      - name: xrp-address
        type: dsl
        dsl:
          - 'regex("(r[0-9a-zA-Z]{24,34})", body)'
          - 'status_code == 200'
        condition: and
# digest: 490a00463044022035f271330e898b0872ee6c27f140d92af76329379c447c371c077d2602f6f37402202135edfe162517311b2c5e1d1e5feceac7f5217d06d6ceda1ca849b62be57061:922c64590222798bb761d5b6d8e72950