id: aaaa-fingerprint

info:
  name: AAAA Record - IPv6 Detection
  author: rxerium
  severity: info
  description: |
    An AAAA record was detected. AAAA records are used to map domain names to IPv6 addresses.
  reference:
    - https://www.cloudflare.com/learning/dns/dns-records/dns-aaaa-record/
    - https://en.wikipedia.org/wiki/IPv6_address
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 1
  tags: dns,aaaa,ipv6,discovery

dns:
  - name: "{{FQDN}}"
    type: AAAA

    matchers:
      - type: regex
        part: answer
        regex:
          - "IN\tAAAA\t(.+)$"

    extractors:
      - type: regex
        group: 1
        regex:
          - "IN\tAAAA\t([0-9a-fA-F:]+)"
# digest: 4b0a00483046022100e5d3d4b5d92a375745b2c274d72b1212999b584867f70b9cbeb53fe689d4109b0221009ac50a1b7de155b5539ca3067d016e84dbc88ed65c1e57eee901b89718ebafec:922c64590222798bb761d5b6d8e72950