diff --git a/dns/cname-service-detector.yaml b/dns/cname-service-detection.yaml similarity index 68% rename from dns/cname-service-detector.yaml rename to dns/cname-service-detection.yaml index fe586cd0ce..dea6bbb752 100644 --- a/dns/cname-service-detector.yaml +++ b/dns/cname-service-detection.yaml @@ -1,7 +1,7 @@ -id: cname-service-detector +id: cname-service-detection info: - name: 3rd party service checker + name: cname service detection author: pdteam severity: info tags: dns @@ -12,13 +12,20 @@ dns: class: inet recursion: true retries: 5 + matchers-condition: or matchers: - type: word name: zendesk words: - "zendesk.com" + - type: word name: github words: - "github.io" + + - type: word + name: announcekit + words: + - "cname.announcekit.app" \ No newline at end of file diff --git a/takeovers/announcekit-takeover.yaml b/takeovers/announcekit-takeover.yaml new file mode 100644 index 0000000000..dcf76b07c1 --- /dev/null +++ b/takeovers/announcekit-takeover.yaml @@ -0,0 +1,31 @@ +id: announcekit-takeover + +info: + name: Announcekit Takeover Detection + author: melbadry9 + severity: high + tags: takeover,announcekit + reference: | + - https://blog.melbadry9.xyz/dangling-dns/xyz-services/dangling-dns-announcekit + - https://github.com/EdOverflow/can-i-take-over-xyz/issues/228 + +requests: + - method: GET + raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 + + redirects: true + max-redirects: 1 + + matchers-condition: and + matchers: + - type: word + words: + - 'Error 404 - AnnounceKit' + + - type: status + status: + - 404