id: posthog-rum-detect

info:
  name: PostHog Browser RUM - Detect
  author: Shivam Kamboj
  severity: info
  description: |
    Detects PostHog Product Analytics & RUM (Real User Monitoring) SDK artifacts in HTML responses.
  reference:
    - https://posthog.com/docs/integrate/client/js
    - https://github.com/PostHog/posthog-js
    - https://www.npmjs.com/package/posthog-js
  metadata:
    max-request: 1
    verified: true
    shodan-query: html:"posthog.init"
  tags: tech,discovery,rum,posthog

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true

    matchers:
      - type: regex
        part: body
        regex:
          - "window\\.posthog"
          - "api_host[\"']?\\s*:\\s*[\"'][^\"']*posthog"
          - "posthog\\.init\\s*\\("
        condition: or
# digest: 4a0a00473045022100b588cb756f9a75d10525ccb720a35f950bd159fd4c98f2cdbfec7e74278ed5100220271948a98672196535a7c827be7b6b3d37e75d80fb51e6b9784e12ff0460d687:922c64590222798bb761d5b6d8e72950