Update and rename betteruptime-takeover.yaml to uptime-takeover.yaml

2024-04-15 10:02:49 +05:30 · 2024-04-15 10:02:49 +05:30 · 0226dc4d7a
parent 63427f8332
commit 0226dc4d7a
2 changed files with 31 additions and 17 deletions
--- a/http/takeovers/betteruptime-takeover.yaml
+++ b/http/takeovers/betteruptime-takeover.yaml
@ -1,17 +0,0 @@
-id: betteruptime-takeover
-
-info:
-  name: betteruptime takeover detection
-  author: philippedelteil
-  severity: info
-  tags: takeover
-  reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/368
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-    matchers:
-      - type: word
-        words:
-          - '<html><body>You are being <a href="https://uptime.betterstack.com">redirected</a>.</body></html>'
--- a/http/takeovers/uptime-takeover.yaml
+++ b/http/takeovers/uptime-takeover.yaml
@ -0,0 +1,31 @@
+id: uptime-takeover
+
+info:
+  name: Uptime Takeover Detection
+  author: philippedelteil
+  severity: high
+  reference:
+    - https://github.com/EdOverflow/can-i-take-over-xyz/issues/368
+  metadata:
+    max-request: 1
+  tags: takeover,uptime
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - Host != ip
+
+      - type: word
+        part: body
+        words:
+          - '<html><body>You are being <a href="https://uptime.betterstack.com">redirected</a>.</body></html>'
+
+      - type: status
+        status:
+          - 302