2021-07-22 08:29:34 +00:00
id : detect-dangling-cname
info :
2022-03-14 13:44:54 +00:00
name : CNAME Detect Dangling
2021-07-22 08:29:34 +00:00
author : pdteam,nytr0gen
severity : info
2022-04-22 10:38:41 +00:00
description : A CNAME detect dangling condition was discovered. Most commonly this relates to failing to remove records from the zone once they are no longer needed.
2021-08-18 11:37:49 +00:00
reference :
2021-08-19 14:44:46 +00:00
- https://securitytrails.com/blog/subdomain-takeover-tips
- https://nominetcyber.com/dangling-dns-is-no-laughing-matter/
- https://nabeelxy.medium.com/dangling-dns-records-are-a-real-vulnerability-361f2a29d37f
- https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
2022-03-14 13:44:54 +00:00
classification :
cwe-id : CWE-200
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-10-14 11:27:55 +00:00
tags : dns,takeover
2021-07-22 08:29:34 +00:00
dns :
- name : "{{FQDN}}"
type : A
2021-12-09 13:05:44 +00:00
2021-07-22 08:29:34 +00:00
matchers-condition : and
matchers :
- type : word
words :
- "NXDOMAIN"
- type : regex
2023-11-05 22:14:35 +00:00
part : answer
2021-07-22 08:29:34 +00:00
regex :
2023-11-05 22:14:35 +00:00
- "IN\tCNAME\t(.+)$"
2023-09-29 15:10:50 +00:00
extractors :
- type : dsl
dsl :
2023-10-14 11:27:55 +00:00
- cname
2023-11-06 06:53:47 +00:00
# digest: 4a0a0047304502201b035521c9d0b1afe37b2bb5326afde1f0022e730b8dd87fa3d247daa558c8a4022100fe8ffe8dec0946abcb2cea2241ed5836041f0fb092417c2eb3ff9b2625ad4dac:922c64590222798bb761d5b6d8e72950
