id: github-takeover
info:
name: github takeover detection
author: pdteam
severity: high
tags: takeover,github
reference: https://github.com/EdOverflow/can-i-take-over-xyz
requests:
- method: GET
path:
- "{{BaseURL}}"
matchers-condition: and
matchers:
- type: word
words:
- "There isn't a GitHub Pages site here."
- "For root URLs (like http://example.com/) you must provide an index.html file"
condition: or
- type: dsl
dsl:
- '!contains(host,"githubapp.com")'
- '!contains(host,"github.com")'
- '!contains(host,"github.io")'
