Merge pull request #183 from secureITmania/master

S3 takeover pattern
patch-1
bauthard 2020-07-04 16:57:49 +05:30 committed by GitHub
commit b8e86d44f7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 0 deletions

View File

@ -0,0 +1,21 @@
id: s3-subtakeover
info:
author: >-
manikanta a.k.a @secureitmania writeup link
https://link.medium.com/fgXKJHR9P7
name: Subdomain takeover for aws S3
severity: high
requests:
- method: GET
path:
- '{{BaseURL}}/'
redirects: false
matchers-condition: and
matchers:
- type: status
status:
- 307
- type: word
words:
- 'Location: https://aws.amazon.com/s3/'
part: header