id: microsoft-teams-webhook

info:
  name: Microsoft Teams Webhook Disclosure
  author: Ice3man
  severity: info
  reference:
    - https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/what-are-webhooks-and-connectors
  metadata:
    max-request: 1
  tags: exposure,token,microsoft,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        part: body
        regex:
          - 'https://outlook\.office\.com/webhook/[A-Za-z0-9\-@]+/IncomingWebhook/[A-Za-z0-9\-]+/[A-Za-z0-9\-]+'
# digest: 4b0a00483046022100a81e20cc38f779c6ba4c84cf360fd1f43d7420a3cb6b8e730733b1daaf7a223002210091e8954df859bc39f4a35ab61f28eee22259776949169d6eb688c568e8168c39:922c64590222798bb761d5b6d8e72950