id: onion-website-supported

info:
  name: Onion Website Supported via Onion-Location Header
  author: rxerium
  severity: info
  description: |
    Identified websites that supported Tor network access through the Onion-Location HTTP response header, which pointed to a corresponding .onion service for enhanced privacy and anonymity.
  metadata:
    verified: true
    max-request: 1
  tags: misc,osint,tor,onion

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?i)onion-location:\s*https?://[a-z0-9]+\.onion'

    extractors:
      - type: regex
        part: header
        group: 1
        regex:
          - '(?i)onion-location:\s*(https?://[a-z0-9]+\.onion)'
# digest: 490a0046304402207159114b6c544b89b35de83a83a6a9241e9aecdd953b13ae47062bfc675e22ac02207854a232d0b3d519c3ec0d43055ef2843110ce0794f5c54d33f6950f29cc1440:922c64590222798bb761d5b6d8e72950