daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/dns/azure-takeover-detection.yaml

54 lines
2.1 KiB
YAML
Raw Normal View History

added dns based azure takeovers
2020-04-29 10:23:17 +00:00
id: azure-takeover-detection
info:
Dashboard Text Enhancements (#3901) Dashboard Text Enhancements
2022-03-14 13:44:54 +00:00
name: Microsoft Azure Takeover Detection
more tags for panels
2021-04-06 07:25:57 +00:00
author: pdteam
added dns based azure takeovers
2020-04-29 10:23:17 +00:00
severity: high
Update azure-takeover-detection.yaml Is better to check for the CNAME values instead of words in the response. A lot of false positives appear if they contain on of the terms to match, example: azurewebsites.net.reddog.microsoft.com
2024-05-10 10:34:53 +00:00
description: Microsoft Azure is vulnerable to subdomain takeover attacks. Subdomain takeovers are a common, high-severity threat for organizations that regularly create and delete many resources. A subdomain takeover can occur when a D>
Dashboard Text Enhancements (#3901) Dashboard Text Enhancements
2022-03-14 13:44:54 +00:00
reference:
- https://godiego.co/posts/STO/
- https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
- https://cystack.net/research/subdomain-takeover-chapter-two-azure-services/
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 7.2
Dashboard Text Enhancements (#3901) Dashboard Text Enhancements
2022-03-14 13:44:54 +00:00
cwe-id: CWE-404
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
templateman update
2023-10-14 11:27:55 +00:00
tags: dns,takeover,azure
added dns based azure takeovers
2020-04-29 10:23:17 +00:00
dns:
Update syntax
2020-05-25 07:54:40 +00:00
- name: "{{FQDN}}"
type: A
update: dns template format update (#3305)
2021-12-09 13:05:44 +00:00
Update syntax
2020-05-25 07:54:40 +00:00
matchers-condition: and
matchers:
added dns based azure takeovers
2020-04-29 10:23:17 +00:00
- type: word
Update syntax
2020-05-25 07:54:40 +00:00
words:
Update azure-takeover-detection.yaml Is better to check for the CNAME values instead of words in the response. A lot of false positives appear if they contain on of the terms to match, example: azurewebsites.net.reddog.microsoft.com
2024-05-10 10:34:53 +00:00
- NXDOMAIN
- type: dsl
dsl:
- 'contains(cname, "azure-api.net")'
- 'contains(cname, "azure-mobile.net")'
- 'contains(cname, "azurecontainer.io")'
- 'contains(cname, "azurecr.io")'
- 'contains(cname, "azuredatalakestore.net")'
- 'contains(cname, "azureedge.net")'
- 'contains(cname, "azurefd.net")'
- 'contains(cname, "azurehdinsight.net")'
- 'contains(cname, "azurewebsites.net")'
- 'contains(cname, "azurewebsites.windows.net")'
- 'contains(cname, "blob.core.windows.net")'
- 'contains(cname, "cloudapp.azure.com")'
- 'contains(cname, "cloudapp.net")'
- 'contains(cname, "database.windows.net")'
- 'contains(cname, "redis.cache.windows.net")'
- 'contains(cname, "search.windows.net")'
- 'contains(cname, "servicebus.windows.net")'
- 'contains(cname, "trafficmanager.net")'
- 'contains(cname, "visualstudio.com")'
Update azure-takeover-detection.yaml This will display what type of service take over is possible.
2021-09-14 23:53:58 +00:00
extractors:
fixes dns templates
2023-09-29 15:10:50 +00:00
- type: dsl
dsl:
- cname
Auto Template Signing [Mon May 13 09:12:58 UTC 2024] :robot:
2024-05-13 09:12:58 +00:00
# digest: 4b0a00483046022100d68568731abdd8cfc97f8e47d3886209656605e7c73bfe62944a9d0d440bdd0d0221009fbd2c17dbd3f8faf9eae5e17223431a603a59249c6d151b36f22bbd4723ad6c:922c64590222798bb761d5b6d8e72950