added dns based azure takeovers

dns/azure-cnames-finder.yaml

@@ -16,14 +16,12 @@ dns:
       matchers:
       - type: word
         words: 
-          - "NXDOMAIN"
           - "azure-api.net"
           - "azure-mobile.net"
           - "azurecontainer.io"
           - "azurecr.io"
           - "azuredatalakestore.net"
           - "azureedge.net"
-          - "azureedge.net "
           - "azurefd.net"
           - "azurehdinsight.net"
           - "azurewebsites.net"
@@ -31,9 +29,7 @@ dns:
           - "blob.core.windows.net"
           - "cloudapp.azure.com"
           - "cloudapp.net"
-          - "cloudapp.net "
           - "database.windows.net"
-          - "elasticbeanstalk.com"
           - "redis.cache.windows.net"
           - "search.windows.net"
           - "servicebus.windows.net"

dns/azure-takeover-detection.yaml

@@ -0,0 +1,44 @@
+id: azure-takeover-detection
+
+info:
+  name: Azure takeover detection
+  author: "pdnuclei - projectdiscovery.io" 
+  severity: high
+
+  # Update the list with more cnames related to azure
+  # You need to claim the cname in Azure portal (https://portal.azure.com) to confirm the takeover.
+  # Do not report this without claiming the cname.
+
+dns:
+    - name: "{{FQDN}}"
+      type: A
+      class: inet
+      recursion: true
+      retries: 3
+      matchers-condition: and
+      matchers:
+      - type: word
+        words: 
+          - "azure-api.net"
+          - "azure-mobile.net"
+          - "azurecontainer.io"
+          - "azurecr.io"
+          - "azuredatalakestore.net"
+          - "azureedge.net"
+          - "azurefd.net"
+          - "azurehdinsight.net"
+          - "azurewebsites.net"
+          - "azurewebsites.windows.net"
+          - "blob.core.windows.net"
+          - "cloudapp.azure.com"
+          - "cloudapp.net"
+          - "database.windows.net"
+          - "redis.cache.windows.net"
+          - "search.windows.net"
+          - "servicebus.windows.net"
+          - "trafficmanager.net"
+          - "visualstudio.com"
+
+      - type: word
+        words:
+          - "NXDOMAIN"