Merge pull request #1103 from projectdiscovery/takeover-breakdown

Takeover templates breakdown (thanks to request clustering)

.github/scripts/README.tmpl

@@ -35,13 +35,13 @@ An overview of the nuclei template directory including number of templates assoc
 <tr>
 <td> 
 
-| Templates      | Counts                         | Templates       | Counts                          | Templates        | Counts                         |
-| -------------- | ------------------------------ | --------------- | ------------------------------- | ---------------- | ------------------------------ |
-| cves           | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels   | {countTpl("exposed-panels")}   |
-| exposures      | {countTpl("exposures/*")}      | technologies    | {countTpl("technologies")}      | misconfiguration | {countTpl("misconfiguration")} |
-| workflows      | {countTpl("workflows")}        | miscellaneous   | {countTpl("miscellaneous")}     | default-logins   | {countTpl("default-logins/*")} |
-| exposed-tokens | {countTpl("exposed-tokens/*")} | dns             | {countTpl("dns")}               | fuzzing          | {countTpl("fuzzing")}          |
-| helpers        | {countTpl("helpers/*")}        | iot             | {countTpl("iot")}               | takeovers        | {countTpl("takeovers")}        |
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
+| takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
+| misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
+| default-logins   | {countTpl("default-logins/*")} | exposed-tokens  | {countTpl("exposed-tokens/*")}  | dns            | {countTpl("dns")}            |
+| fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |
 
 **{command("tree", -2, None)}**.
 

takeovers/acquia-takeover.yaml

@@ -0,0 +1,20 @@
+id: acquia-takeover
+
+info:
+  name: Acquia Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        name: acquia
+        words:
+          - If you are an Acquia Cloud customer and expect to see your site at this address
+          - The site you are looking for could not be found.

takeovers/aftership-takeover.yaml

@@ -0,0 +1,19 @@
+id: aftership-takeover
+
+info:
+  name: Aftership Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Oops.</h2><p class="text-muted text-tight">The page you're looking for doesn't
+            exist.

takeovers/agilecrm-takeover.yaml

@@ -0,0 +1,18 @@
+id: agilecrm-takeover
+
+info:
+  name: agilecrm takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Sorry, this page is no longer available.

takeovers/aha-takeover.yaml

@@ -0,0 +1,18 @@
+id: aha-takeover
+
+info:
+  name: Aha Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - There is no portal here ... sending you back to Aha!

takeovers/airee-takeover.yaml

@@ -0,0 +1,19 @@
+id: airee-takeover
+
+info:
+  name: Airee Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        name: airee
+        words:
+          - Ошибка 402. Сервис Айри.рф не оплачен

takeovers/anima-takeover.yaml

@@ -0,0 +1,18 @@
+id: anima-takeover
+
+info:
+  name: Anima Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "If this is your website and you've just created it, try refreshing in a minute"

takeovers/aws-bucket-takeover.yaml

@@ -0,0 +1,18 @@
+id: aws-bucket-takeover
+
+info:
+  name: AWS Bucket Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover,aws
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "The specified bucket does not exist"

takeovers/bigcartel-takeover.yaml

@@ -0,0 +1,17 @@
+id: bigcartel-takeover
+
+info:
+  name: Bigcartel Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers:
+      - type: word
+        words:
+          - "<h1>Oops! We couldn&#8217;t find that page.</h1>"

takeovers/bitbucket-takeover.yaml

@@ -0,0 +1,19 @@
+id: bitbucket-takeover
+
+info:
+  name: Bitbucket Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - The page you have requested does not exist
+          - Repository not found

takeovers/brightcove-takeover.yaml

@@ -0,0 +1,19 @@
+id: brightcove-takeover
+
+info:
+  name: brightcove takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+
+      - type: word
+        words:
+          - '<p class="bc-gallery-error-code">Error Code: 404</p>'

takeovers/campaignmonitor.yaml

@@ -0,0 +1,19 @@
+id: campaignmonitor-takeover
+
+info:
+  name: campaignmonitor takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "<strong>Trying to access your account?</strong>"
+          - or <a href="mailto:help@createsend.com

takeovers/canny-takeover.yaml

@@ -0,0 +1,19 @@
+id: canny-takeover
+
+info:
+  name: canny takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Company Not Found
+          - There is no such company. Did you enter the right URL?

takeovers/cargo-takeover.yaml

@@ -0,0 +1,19 @@
+id: cargo-takeover
+
+info:
+  name: cargo takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - If you're moving your domain away from Cargo you must make this configuration
+            through your registrar's DNS control panel.

takeovers/cargocollective-takeover.yaml

@@ -0,0 +1,19 @@
+id: cargocollective-takeover
+
+info:
+  name: cargocollective takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - <div class="notfound">
+          - 404 Not Found<br>

takeovers/fastly-takeover.yaml

@@ -0,0 +1,18 @@
+id: fastly-takeover
+
+info:
+  name: fastly takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "Fastly error: unknown domain:"

takeovers/feedpress-takeover.yaml

@@ -0,0 +1,18 @@
+id: feedpress-takeover
+
+info:
+  name: Agilecrm Takeover Detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - The feed has not been found.

takeovers/frontify-takeover.yaml

@@ -0,0 +1,20 @@
+id: frontify-takeover
+
+info:
+  name: frontify takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - 404 - Page Not Found
+          - Oops… looks like you got lost
+        condition: and

takeovers/gemfury-takeover.yaml

@@ -0,0 +1,18 @@
+id: gemfury-takeover
+
+info:
+  name: gemfury takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "404: This page could not be found."

takeovers/getresponse-takeover.yaml

@@ -0,0 +1,18 @@
+id: getresponse-takeover
+
+info:
+  name: getresponse takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - With GetResponse Landing Pages, lead generation has never been easier

takeovers/ghost-takeover.yaml

@@ -0,0 +1,19 @@
+id: ghost-takeover
+
+info:
+  name: ghost takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - The thing you were looking for is no longer here
+          - The thing you were looking for is no longer here, or never was

takeovers/github-takeover.yaml

@@ -0,0 +1,19 @@
+id: github-takeover
+
+info:
+  name: github takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - There isn't a GitHub Pages site here.
+          - For root URLs (like http://example.com/) you must provide an index.html file

takeovers/hatenablog-takeover.yaml

@@ -0,0 +1,19 @@
+id: hatenablog-takeover
+
+info:
+  name: hatenablog takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - 404 Blog is not found
+          - Sorry, we can't find the page you're looking for.

takeovers/helpjuice-takeover.yaml

@@ -0,0 +1,18 @@
+id: helpjuice-takeover
+
+info:
+  name: helpjuice takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - We could not find what you're looking for.

takeovers/helprace-takeover.yaml

@@ -0,0 +1,21 @@
+id: helprace-takeover
+
+info:
+  name: helprace takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+
+      - type: word
+        words:
+          - Alias not configured!
+          - Admin of this Helprace account needs to set up domain alias
+          - "(see Step 2 here: Using your own domain with Helprace)."

takeovers/helpscout-takeover.yaml

@@ -0,0 +1,19 @@
+id: helpscout-takeover
+
+info:
+  name: helpscout takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+
+      - type: word
+        words:
+          - "No settings were found for this company:"

takeovers/heroku-takeover.yaml

@@ -0,0 +1,20 @@
+id: heroku-takeover
+
+info:
+  name: heroku takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - There's nothing here, yet.
+          - herokucdn.com/error-pages/no-such-app.html
+          - "<title>No such app</title>"

takeovers/hubspot-takeover.yaml

@@ -0,0 +1,19 @@
+id: hubspot-takeover
+
+info:
+  name: hubspot takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Domain not found
+          - does not exist in our system

takeovers/intercom-takeover.yaml

@@ -0,0 +1,19 @@
+id: intercom-takeover
+
+info:
+  name: intercom takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - This page is reserved for artistic dogs.
+          - <h1 class="headline">Uh oh. That page doesn’t exist.</h1>

takeovers/jazzhr-takeover.yaml

@@ -0,0 +1,18 @@
+id: jazzhr-takeover
+
+info:
+  name: jazzhr takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - This account no longer active

takeovers/jetbrains-takeover.yaml

@@ -0,0 +1,17 @@
+id: jetbrains-takeover
+
+info:
+  name: jetbrains takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers:
+      - type: word
+        words:
+          - is not a registered InCloud YouTrack.

takeovers/kinsta-takeover.yaml

@@ -0,0 +1,18 @@
+id: kinsta-takeover
+
+info:
+  name: kinsta takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - No Site For Domain

takeovers/landingi-takeover.yaml

@@ -0,0 +1,19 @@
+id: landingi-takeover
+
+info:
+  name: landingi takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - It looks like you're lost
+          - The page you are looking for is not found

takeovers/launchrock-takeover.yaml

@@ -0,0 +1,19 @@
+id: launchrock-takeover
+
+info:
+  name: launchrock takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
+            to all of us.

takeovers/mashery-takeover.yaml

@@ -0,0 +1,18 @@
+id: mashery-takeover
+
+info:
+  name: mashery takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Unrecognized domain <strong>

takeovers/netlify-takeover.yaml

@@ -0,0 +1,24 @@
+id: netlify-takeover
+
+info:
+  name: netlify takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Not Found"
+
+      - type: word
+        words:
+          - "server: Netlify"
+        part: header

takeovers/ngrok-takeover.yaml

@@ -0,0 +1,20 @@
+id: ngrok-takeover
+
+info:
+  name: ngrok takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - ngrok.io not found
+          - Tunnel *.ngrok.io not found

takeovers/pantheon-takeover.yaml

@@ -0,0 +1,18 @@
+id: pantheon-takeover
+
+info:
+  name: pantheon takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "The gods are wise, but do not know of the site which you seek."

takeovers/pingdom-takeover.yaml

@@ -0,0 +1,19 @@
+id: pingdom-takeover
+
+info:
+  name: pingdom takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Public Report Not Activated
+          - This public report page has not been activated by the user

takeovers/proposify-takeover.yaml

@@ -0,0 +1,18 @@
+id: proposify-takeover
+
+info:
+  name: proposify takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - If you need immediate assistance, please contact <a href="mailto:support@proposify.biz

takeovers/readme-takeover.yaml

@@ -0,0 +1,18 @@
+id: readme-takeover
+
+info:
+  name: readme takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Project doesnt exist... yet!

takeovers/readthedocs-takeover.yaml

@@ -0,0 +1,18 @@
+id: readthedocs-takeover
+
+info:
+  name: readthedocs takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - unknown to Read the Docs

takeovers/shopify-takeover.yaml

@@ -0,0 +1,19 @@
+id: shopify-takeover
+
+info:
+  name: shopify takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "Sorry, this shop is currently unavailable."
+          - 'To finish setting up your new web address, go to your domain settings, click "Connect existing domain"'

takeovers/simplebooklet-takeover.yaml

@@ -0,0 +1,18 @@
+id: simplebooklet-takeover
+
+info:
+  name: simplebooklet takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - We can't find this <a href="https://simplebooklet.com

takeovers/smartjob-takeover.yaml

@@ -0,0 +1,20 @@
+id: smartjob-takeover
+
+info:
+  name: smartjob takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Job Board Is Unavailable
+          - This job board website is either expired
+          - This job board website is either expired or its domain name is invalid.

takeovers/smartling-takeover.yaml

@@ -0,0 +1,17 @@
+id: smartling-takeover
+
+info:
+  name: smartling takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers:
+      - type: word
+        words:
+          - Domain is not configured

takeovers/smugmug-takeover.yaml

@@ -0,0 +1,18 @@
+id: smugmug-takeover
+
+info:
+  name: smugmug takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - '{"text":"Page Not Found"'

takeovers/strikingly-takeover.yaml

@@ -0,0 +1,19 @@
+id: strikingly-takeover
+
+info:
+  name: strikingly takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - But if you're looking to build your own website
+          - you've come to the right place.

takeovers/subdomain-takeover.yaml

@@ -1,399 +0,0 @@
-id: detect-all-takeovers
-
-info:
-  name: Subdomain Takeover Detection
-  author: "melbadry9 & pxmme1337 & geeknik"
-  severity: high
-  tags: takeover
-
-  # Update this list with new takeovers matchers
-  # Do not delete other template files for takeover
-  # https://github.com/EdOverflow/can-i-take-over-xyz
-  # You need to claim the subdomain / CNAME of the subdomain to confirm the takeover.
-  # Do not report subdomain takeover issues only based on detection.
-  # Total number of services #72
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-    matchers-condition: or
-
-    matchers:
-      - type: word
-        name: acquia
-        words:
-          - If you are an Acquia Cloud customer and expect to see your site at this address
-          - The site you are looking for could not be found.
-
-      - type: word
-        name: agilecrm
-        words:
-          - Sorry, this page is no longer available.
-
-      - type: word
-        name: airee
-        words:
-          - Ошибка 402. Сервис Айри.рф не оплачен
-
-      - type: word
-        name: aftership
-        words:
-          - Oops.</h2><p class="text-muted text-tight">The page you're looking for doesn't
-            exist.
-
-      - type: word
-        name: aha
-        words:
-          - There is no portal here ... sending you back to Aha!
-
-      - type: word
-        name: anima
-        words:
-          - "If this is your website and you've just created it, try refreshing in a minute"
-
-      - type: word
-        name: aws-bucket
-        words:
-          - "The specified bucket does not exist"
-
-      - type: word
-        name: bigcartel
-        words:
-          - "<h1>Oops! We couldn&#8217;t find that page.</h1>"
-
-      - type: word
-        name: bitbucket
-        words:
-          - The page you have requested does not exist
-          - Repository not found
-
-      - type: word
-        name: brightcove
-        words:
-          - '<p class="bc-gallery-error-code">Error Code: 404</p>'
-
-      - type: word
-        name: campaignmonitor
-        words:
-          - "<strong>Trying to access your account?</strong>"
-          - or <a href="mailto:help@createsend.com
-
-      - type: word
-        name: canny
-        words:
-          - Company Not Found
-          - There is no such company. Did you enter the right URL?
-
-      - type: word
-        name: cargo
-        words:
-          - If you're moving your domain away from Cargo you must make this configuration
-            through your registrar's DNS control panel.
-
-      - type: word
-        name: cargocollective
-        words:
-          - <div class="notfound">
-          - 404 Not Found<br>
-
-      - type: word
-        name: fastly
-        words:
-          - "Fastly error: unknown domain:"
-
-      - type: word
-        name: feedpress
-        words:
-          - The feed has not been found.
-
-      - type: word
-        name: frontify
-        words:
-          - 404 - Page Not Found
-          - Oops… looks like you got lost
-        condition: and
-        part: body
-
-      - type: word
-        name: gemfury
-        words:
-          - "404: This page could not be found."
-
-      - type: word
-        name: getresponse
-        words:
-          - With GetResponse Landing Pages, lead generation has never been easier
-
-      - type: word
-        name: ghost
-        words:
-          - The thing you were looking for is no longer here
-          - The thing you were looking for is no longer here, or never was
-
-      - type: word
-        name: github
-        words:
-          - There isn't a GitHub Pages site here.
-          - For root URLs (like http://example.com/) you must provide an index.html file
-
-      - type: word
-        name: hatenablog
-        words:
-          - 404 Blog is not found
-          - Sorry, we can't find the page you're looking for.
-
-      - type: word
-        name: helpjuice
-        words:
-          - We could not find what you're looking for.
-
-      - type: word
-        name: helprace
-        words:
-          - Alias not configured!
-          - Admin of this Helprace account needs to set up domain alias
-          - "(see Step 2 here: Using your own domain with Helprace)."
-
-      - type: word
-        name: helpscout
-        words:
-          - "No settings were found for this company:"
-
-      - type: word
-        name: heroku
-        words:
-          - There's nothing here, yet.
-          - herokucdn.com/error-pages/no-such-app.html
-          - "<title>No such app</title>"
-
-      - type: word
-        name: hubspot
-        words:
-          - Domain not found
-          - does not exist in our system
-
-      - type: word
-        name: intercom
-        words:
-          - This page is reserved for artistic dogs.
-          - <h1 class="headline">Uh oh. That page doesn’t exist.</h1>
-
-      - type: word
-        name: jazzhr
-        words:
-          - This account no longer active
-
-      - type: word
-        name: jetbrains
-        words:
-          - is not a registered InCloud YouTrack.
-
-      - type: word
-        name: kinsta
-        words:
-          - No Site For Domain
-
-      - type: word
-        name: landingi
-        words:
-          - It looks like you're lost
-          - The page you are looking for is not found
-
-      - type: word
-        name: launchrock
-        words:
-          - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
-            to all of us.
-
-      - type: word
-        name: mashery
-        words:
-          - Unrecognized domain <strong>
-
-      - type: word
-        name: ngrok
-        words:
-          - ngrok.io not found
-          - Tunnel *.ngrok.io not found
-
-      - type: word
-        name: pantheon.io
-        words:
-          - "The gods are wise, but do not know of the site which you seek."
-
-      - type: word
-        name: pingdom
-        words:
-          - Public Report Not Activated
-          - This public report page has not been activated by the user
-
-      - type: word
-        name: proposify
-        words:
-          - If you need immediate assistance, please contact <a href="mailto:support@proposify.biz
-
-      - type: word
-        name: readme
-        words:
-          - Project doesnt exist... yet!
-
-      - type: word
-        name: shopify
-        words:
-          - "Sorry, this shop is currently unavailable."
-          - 'To finish setting up your new web address, go to your domain settings, click "Connect existing domain"'
-
-      - type: word
-        name: simplebooklet
-        words:
-          - We can't find this <a href="https://simplebooklet.com
-
-      - type: word
-        name: smartjob
-        words:
-          - Job Board Is Unavailable
-          - This job board website is either expired
-          - This job board website is either expired or its domain name is invalid.
-
-      - type: word
-        name: smartling
-        words:
-          - Domain is not configured
-
-      - type: word
-        name: smugmug
-        words:
-          - '{"text":"Page Not Found"'
-
-      - type: word
-        name: strikingly
-        words:
-          - But if you're looking to build your own website
-          - you've come to the right place.
-
-      - type: word
-        name: surge
-        words:
-          - project not found
-
-      - type: word
-        name: surveygizmo
-        words:
-          - data-html-name
-
-      - type: word
-        name: tave
-        words:
-          - "<h1>Error 404: Page Not Found</h1>"
-
-      - type: word
-        name: teamwork
-        words:
-          - Oops - We didn't find your site.
-
-      - type: word
-        name: tictail
-        words:
-          - Building a brand of your own?
-          - 'to target URL: <a href="https://tictail.com'
-          - Start selling on Tictail.
-
-      - type: word
-        name: tilda
-        words:
-          - Domain has been assigned
-
-      - type: word
-        name: tumblr
-        words:
-          - Whatever you were looking for doesn't currently exist at this address.
-          - There's nothing here.
-
-      - type: word
-        name: uberflip
-        words:
-          - "Non-hub domain, The URL you've accessed does not provide a hub."
-
-      - type: regex
-        name: unbounce
-        regex:
-          - "^The requested URL was not found on this server.$"
-
-      - type: regex
-        name: uptimerobot
-        regex:
-          - "^page not found$"
-
-      - type: word
-        name: uservoice
-        words:
-          - This UserVoice subdomain is currently available!
-
-      - type: word
-        name: vend
-        words:
-          - Looks like you've traveled too far into cyberspace.
-
-      - type: word
-        name: webflow
-        words:
-          - <p class="description">The page you are looking for doesn't exist or has been
-            moved.</p>
-
-      - type: word
-        name: wishpond
-        words:
-          - https://www.wishpond.com/404?campaign=true
-
-      - type: word
-        name: wordpress
-        words:
-          - Do you want to register
-
-      - type: regex
-        name: worksites
-        regex:
-          - "(?:Company Not Found|you&rsquo;re looking for doesn&rsquo;t exist)"
-
-      - type: word
-        name: wufoo
-        words:
-          - Profile not found
-          - Hmmm....something is not right.
-
-      - type: word
-        name: zendesk
-        words:
-          - this help center no longer exists
-
-      - type: word
-        name: readthedocs
-        words:
-          - unknown to Read the Docs
-
-      - type: word
-        name: tilda
-        words:
-          - <title>Please renew your subscription</title>
-          - Please go to the site settings and put the domain name in the Domain tab.
-
-      - type: word
-        name: smart-jobboard
-        words:
-          - This job board website is either expired or its domain name is invalid.
-
-      - type: word
-        name: netlify
-        words:
-          - "Not Found"
-          - "server: Netlify"
-        condition: and
-        part: all
-
-      - type: word
-        name: vercel
-        words:
-          - The deployment could not be found on Vercel.
-          - DEPLOYMENT_NOT_FOUND
-        condition: and

takeovers/surveygizmo-takeover.yaml

@@ -0,0 +1,18 @@
+id: surveygizmo-takeover
+
+info:
+  name: surveygizmo takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - data-html-name

takeovers/tave-takeover.yaml

@@ -0,0 +1,18 @@
+id: tave-takeover
+
+info:
+  name: tave takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "<h1>Error 404: Page Not Found</h1>"

takeovers/teamwork-takeover.yaml

@@ -0,0 +1,18 @@
+id: teamwork-takeover
+
+info:
+  name: teamwork takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Oops - We didn't find your site.

takeovers/tictail-takeover.yaml

@@ -0,0 +1,20 @@
+id: tictail-takeover
+
+info:
+  name: tictail takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Building a brand of your own?
+          - 'to target URL: <a href="https://tictail.com'
+          - Start selling on Tictail.

takeovers/tilda-takeover.yaml

@@ -0,0 +1,19 @@
+id: tilda-takeover
+
+info:
+  name: tilda takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - <title>Please renew your subscription</title>
+          - Please go to the site settings and put the domain name in the Domain tab.

takeovers/tumblr-takeover.yaml

@@ -0,0 +1,19 @@
+id: tumblr-takeover
+
+info:
+  name: tumblr takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Whatever you were looking for doesn't currently exist at this address.
+          - There's nothing here.

takeovers/uberflip-takeover.yaml

@@ -0,0 +1,18 @@
+id: uberflip-takeover
+
+info:
+  name: uberflip takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "Non-hub domain, The URL you've accessed does not provide a hub."

takeovers/unbounce-takeover.yaml

@@ -0,0 +1,18 @@
+id: unbounce-takeover
+
+info:
+  name: unbounce takeover detection
+  author: pdcommunity
+  severity: info
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: regex
+        regex:
+          - "^The requested URL was not found on this server.$"

takeovers/uptimerobot-takeover.yaml

@@ -0,0 +1,18 @@
+id: uptimerobot-takeover
+
+info:
+  name: uptimerobot takeover detection
+  author: pdcommunity
+  severity: info
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: regex
+        regex:
+          - "^page not found$"

takeovers/urge-takeover.yaml

@@ -0,0 +1,18 @@
+id: surge-takeover
+
+info:
+  name: surge takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - project not found

takeovers/vend-takeover.yaml

@@ -0,0 +1,18 @@
+id: vend-takeover
+
+info:
+  name: vend takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Looks like you've traveled too far into cyberspace.

takeovers/vercel-takeover.yaml

@@ -0,0 +1,20 @@
+id: vercel-takeover
+
+info:
+  name: vercel takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - The deployment could not be found on Vercel.
+          - DEPLOYMENT_NOT_FOUND
+        condition: and

takeovers/webflow-takeover.yaml

@@ -0,0 +1,18 @@
+id: webflow-takeover
+
+info:
+  name: webflow takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - <p class="description">The page you are looking for doesn't exist or has been moved.</p>

takeovers/wishpond-takeover.yaml

@@ -0,0 +1,18 @@
+id: wishpond-takeover
+
+info:
+  name: wishpond takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - https://www.wishpond.com/404?campaign=true

takeovers/wordpress-takeover.yaml

@@ -0,0 +1,18 @@
+id: wordpress-takeover
+
+info:
+  name: wordpress takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Do you want to register

takeovers/worksites-takeover.yaml

@@ -1,7 +1,7 @@
 id: worksites-takeover
 
 info:
-  name: Worksites subdomain takeover
+  name: worksites takeover detection
   author: melbadry9
   severity: high
   tags: takeover
@@ -12,14 +12,7 @@ requests:
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
     matchers:
       - type: word
-        words:
-          - "Company Not Found"
-          - "Hello! Sorry, but the website you’re looking for doesn’t exist."
-        condition: and
-
-      - type: status
-        status:
-          - 404
+        regex:
+          - "(?:Company Not Found|you’re looking for doesn’t exist)"

takeovers/wufoo-takeover.yaml

@@ -0,0 +1,19 @@
+id: wufoo-takeover
+
+info:
+  name: wufoo takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - Profile not found
+          - Hmmm....something is not right.

takeovers/zendesk-takeover.yaml

@@ -0,0 +1,18 @@
+id: zendesk-takeover
+
+info:
+  name: zendesk takeover detection
+  author: pdcommunity
+  severity: high
+  tags: takeover
+  reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - this help center no longer exists