Sublime Security medium experimental mql

Open redirect: HHS

Looks for use of the HHS open redirect.

View Source

Detection Logic

type.inbound
and any(body.links,
        .href_url.domain.domain == 'dcis.hhs.gov'
        and strings.ilike(.href_url.query_params, '*service*')
)

Field Validations

Loading…

Comments (0)

Loading comments...