daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/miscellaneous/detect-dns-over-https.yaml

41 lines
1.3 KiB
YAML
Raw Normal View History

Create detect-dns-over-https.yaml Test validity against any known DoH host like Cloudflare or Google. Can be used to detect surreptitious DoH servers operating inside and outside of your network. ``` $ nuclei -t /opt/test/dns-over-https.yaml -target https://cloudflare-dns.com [2021-03-27 14:19:13] [detect-dns-over-https] [http] [info] https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB ```
2021-03-27 19:26:56 +00:00
id: detect-dns-over-https
info:
name: Detect DNS over HTTPS
author: geeknik
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
severity: info
Update detect-dns-over-https.yaml
2023-05-30 10:04:03 +00:00
description: |
With DNS over HTTPS (DoH), DNS queries and responses are encrypted and sent via the HTTP or HTTP/2 protocols. DoH ensures that attackers cannot forge or alter DNS traffic. DoH uses port 443, which is the standard HTTPS traffic port, to wrap the DNS query in an HTTPS request. DNS queries and responses are camouflaged within other HTTPS traffic, since it all comes and goes from the same port.
Create detect-dns-over-https.yaml Test validity against any known DoH host like Cloudflare or Google. Can be used to detect surreptitious DoH servers operating inside and outside of your network. ``` $ nuclei -t /opt/test/dns-over-https.yaml -target https://cloudflare-dns.com [2021-03-27 14:19:13] [detect-dns-over-https] [http] [info] https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB ```
2021-03-27 19:26:56 +00:00
reference:
- https://developers.google.com/speed/public-dns/docs/doh/
- https://developers.cloudflare.com/1.1.1.1/dns-over-https/wireformat
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
templateman update
2023-10-14 11:27:55 +00:00
tags: dns,doh,misc
Create detect-dns-over-https.yaml Test validity against any known DoH host like Cloudflare or Google. Can be used to detect surreptitious DoH servers operating inside and outside of your network. ``` $ nuclei -t /opt/test/dns-over-https.yaml -target https://cloudflare-dns.com [2021-03-27 14:19:13] [detect-dns-over-https] [http] [info] https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB ```
2021-03-27 19:26:56 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create detect-dns-over-https.yaml Test validity against any known DoH host like Cloudflare or Google. Can be used to detect surreptitious DoH servers operating inside and outside of your network. ``` $ nuclei -t /opt/test/dns-over-https.yaml -target https://cloudflare-dns.com [2021-03-27 14:19:13] [detect-dns-over-https] [http] [info] https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB ```
2021-03-27 19:26:56 +00:00
- method: GET
path:
- "{{BaseURL}}/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB"
templateman update
2023-10-14 11:27:55 +00:00
Create detect-dns-over-https.yaml Test validity against any known DoH host like Cloudflare or Google. Can be used to detect surreptitious DoH servers operating inside and outside of your network. ``` $ nuclei -t /opt/test/dns-over-https.yaml -target https://cloudflare-dns.com [2021-03-27 14:19:13] [detect-dns-over-https] [http] [info] https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB ```
2021-03-27 19:26:56 +00:00
headers:
Accept: application/dns-message
matchers-condition: and
matchers:
- type: status
status:
- 200
misc update
2021-11-03 10:11:08 +00:00
Create detect-dns-over-https.yaml Test validity against any known DoH host like Cloudflare or Google. Can be used to detect surreptitious DoH servers operating inside and outside of your network. ``` $ nuclei -t /opt/test/dns-over-https.yaml -target https://cloudflare-dns.com [2021-03-27 14:19:13] [detect-dns-over-https] [http] [info] https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB ```
2021-03-27 19:26:56 +00:00
- type: word
misc update
2021-11-03 10:11:08 +00:00
part: header
Create detect-dns-over-https.yaml Test validity against any known DoH host like Cloudflare or Google. Can be used to detect surreptitious DoH servers operating inside and outside of your network. ``` $ nuclei -t /opt/test/dns-over-https.yaml -target https://cloudflare-dns.com [2021-03-27 14:19:13] [detect-dns-over-https] [http] [info] https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB ```
2021-03-27 19:26:56 +00:00
words:
- "application/dns-message"
misc update
2021-11-03 10:11:08 +00:00
Update detect-dns-over-https.yaml Every DoH server we tested with this query payload responded with a Content-Length of 49. 👍🏻
2021-03-27 21:29:35 +00:00
- type: regex
misc update
2021-11-03 10:11:08 +00:00
part: header
Update detect-dns-over-https.yaml Every DoH server we tested with this query payload responded with a Content-Length of 49. 👍🏻
2021-03-27 21:29:35 +00:00
regex:
- "(C|c)ontent-(L|l)ength: 49"
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot:
2023-10-20 11:41:13 +00:00
# digest: 490a0046304402207195d648ce176a7848cdcc55a2b83fa36294ce45dc12c4c82caac17d9b7f91360220305b6b979ffa0c0299474ff1ed78c478c9d4a7c06a5a0295098301e352ab2502:922c64590222798bb761d5b6d8e72950