ssh-keys.yaml

send:
  - method: 'GET'
    url: '.ssh'

  - method: 'GET'
    url: '.ssh.asp'

  - method: 'GET'
    url: '.ssh.php'
  
  - method: 'GET'
    url: '.ssh/id_dsa'

  - method: 'GET'
    url: '.ssh/id_rsa'

  - method: 'GET'
    url: '.ssh/id_rsa.key'

  - method: 'GET'
    url: '.ssh/id_rsa.key~'

  - method: 'GET'
    url: '.ssh/id_rsa.priv'

  - method: 'GET'
    url: '.ssh/id_rsa.priv~'

  - method: 'GET'
    url: '.ssh/id_rsa.pub'

  - method: 'GET'
    url: '.ssh/id_rsa.pub~'

  - method: 'GET'
    url: '.ssh/id_rsa~'

  - method: 'GET'
    url: 'id_dsa'

  - method: 'GET'
    url: 'id_dsa.ppk'

  - method: 'GET'
    url: 'id_rsa'

  - method: 'GET'
    url: 'id_rsa.pub'

detect:
  - response:
    - body: '-----BEGIN RSA PRIVATE KEY-----'
    - body: '-----BEGIN ENCRYPTED PRIVATE KEY-----'
    - body: '-----BEGIN PUBLIC KEY-----'
    - body: '-----BEGIN DSA PRIVATE KEY-----'
    - body: 'ssh-rsa'
    - body: 'ssh-dsa'

meta-info:
  - type: info
  - threat: 30
  - applicable_for:
    - fast
    - scanner
  - tags:
    - Information Exposure
    - ssh authorized_keys