diff --git a/http/takeovers/gohire-takeover.yaml b/http/takeovers/gohire-takeover.yaml new file mode 100644 index 0000000000..e2a3b76eaa --- /dev/null +++ b/http/takeovers/gohire-takeover.yaml @@ -0,0 +1,31 @@ +id: gohire-takeover + +info: + name: GoHire Takeover Detection + author: philippedelteil + severity: high + reference: + - https://github.com/EdOverflow/can-i-take-over-xyz/issues/403 + metadata: + max-request: 1 + tags: takeover,gohire + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: dsl + dsl: + - Host != ip + + - type: word + part: body + words: + - 'You may have followed an invalid link or the job you are looking for has been archived' + + - type: status + status: + - 404