id: hotjar-rum-detect

info:
  name: Hotjar RUM - Detect
  author: Shivam Kamboj
  severity: info
  description: |
    Detects Hotjar Web Analytics & Session Recording artifacts.
  reference:
    - https://www.hotjar.com/
  metadata:
    max-request: 1
    verified: true
    shodan-query: http.html:"static.hotjar.com"
    fofa-query: body="hotjar" || header="hotjar"
  tags: tech,discovery,rum,hotjar

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    max-redirects: 3

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 || status_code == 400"
        condition: and

      - type: regex
        part: body
        regex:
          - "h\\._hjSettings\\s*=\\s*\\{\\s*hjid\\s*:"
          - "_hjSettings\\s*=\\s*\\{\\s*hjid\\s*:"
          - "<script[^>]*src=['\"][^'\"]*static\\.hotjar\\.com[^'\"]*['\"]"
          - "<script[^>]*src=['\"][^'\"]*script\\.hotjar\\.com[^'\"]*['\"]"
          - "window\\.hj\\s*=\\s*window\\.hj\\s*\\|\\|"
          - "\\(function\\s*\\([^)]*\\)\\s*\\{[^}]*hotjar[^}]*hjid"
        condition: or
# digest: 4a0a00473045022100c8e636665e759407af827f9d2570ef23b8eba46ef37de7c7ebb5ffada5fd3281022005b0adbb51012cffbe8508c55acf8b3348732d4ff6bc30c88e730b6642a862ce:922c64590222798bb761d5b6d8e72950