From 816472b48fec558d8323b7b933b43d4c88830439 Mon Sep 17 00:00:00 2001
From: bauthard <ehsandeepsingh@gmail.com>
Date: Sun, 26 Apr 2020 04:22:04 +0000
Subject: [PATCH] adding master takeover template

---
 subdomain-takeover/detect-all-takeovers.yaml | 38 ++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 subdomain-takeover/detect-all-takeovers.yaml

diff --git a/subdomain-takeover/detect-all-takeovers.yaml b/subdomain-takeover/detect-all-takeovers.yaml
new file mode 100644
index 0000000000..9a463a21d7
--- /dev/null
+++ b/subdomain-takeover/detect-all-takeovers.yaml
@@ -0,0 +1,38 @@
+id: detect-all-takeovers
+
+info:
+  name: Subdomain takeover finder
+  author: pxmme1337
+  severity: high
+
+  # update this list with new takeovers matchers
+  # do not delete other template files for takeover
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+    matchers-condition: or
+    matchers:
+      - type: word
+        name: pantheon.io
+        words:
+          - "The gods are wise, but do not know of the site which you seek."
+      - type: word
+        name: aws-s3-bucket
+        words:
+          - "The specified bucket does not exist"
+      - type: word
+        name: anima
+        words:
+          - "If this is your website and you've just created it, try refreshing in a minute"
+      - type: word
+        name: ghost
+        words:
+          - "The thing you were looking for is no longer here, or never was"
+      - type: regex
+        name: worksites
+        regex:
+            - "(?:Company Not Found|you&rsquo;re looking for doesn&rsquo;t exist)"
+        part: body
+