2021-07-07 02:16:40 +00:00
|
|
|
id: ceros-takeover
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: ceros takeover detection
|
|
|
|
|
author: abison_binoy
|
2021-07-10 09:26:54 +00:00
|
|
|
severity: info
|
2021-07-07 02:16:40 +00:00
|
|
|
tags: takeover
|
2021-07-10 09:26:54 +00:00
|
|
|
reference: |
|
|
|
|
|
- https://twitter.com/abison_binoy/status/1412606224030339072
|
|
|
|
|
- https://www.ceros.com/educate/help_center/using-your-own-vanity-domain/
|
2021-07-07 02:16:40 +00:00
|
|
|
|
|
|
|
|
requests:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}"
|
|
|
|
|
|
|
|
|
|
matchers:
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
2021-07-10 09:26:54 +00:00
|
|
|
- "Sorry, page not found"
|
|
|
|
|
- "Please check the url and"
|
2021-07-10 09:33:54 +00:00
|
|
|
- "/view.ceros.com/"
|
2021-07-07 02:16:40 +00:00
|
|
|
condition: and
|
