id: bubble-detect

info:
  name: Bubble - Detect
  author: johnk3r
  severity: info
  description: |
    Detected the presence of Bubble, an AI-powered no-code app platform.
  reference:
    - https://bubble.io/
  metadata:
    verified: true
    max-request: 1
    vendor: bubble
    product: bubble
    shodan-query: X-Bubble-Perf
    fofa-query: header="X-Bubble"
  tags: tech,bubble,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(to_lower(header), "x-bubble-", "__bubble") || contains_any(body, "bubble.io", "bubbleapps.io")'
        condition: and
# digest: 4b0a00483046022100ee9ba87147165740a5041077ea832625ff2d1dc52a131604d85688be5e5752a2022100a661c2178894995cd43d3956cd05d0bf210702599e07c016c462b1655794df88:922c64590222798bb761d5b6d8e72950