id: nostr-json-exposure

info:
  name: Well-Known Nostr JSON
  author: rxerium
  severity: info
  description: |
    Detects Nostr public key discovery JSON.
  impact: |
    Presence of this well-known resource can expose implementation details or policies.
  reference:
    - https://github.com/nostr-protocol/nips/blob/master/05.md
  metadata:
    google-query: inurl:"/.well-known/nostr.json"
  tags: well-known,nostr,miscellaneous,misc,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/nostr.json"

    max-redirects: 1
    redirects: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"names": {'

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502202ef5221c391f63231d4976c8b823c673cdf16c25c37c8db70deffadd8202f2d0022100a04f9a5c69fff68140937e9af58da9e4e57c03162122fce256dd26f6c28e275f:922c64590222798bb761d5b6d8e72950