id: azure-vm-cloud-enum

info:
  name: Azure Virtual Machines - Cloud Enumeration
  author: initstring
  severity: info
  description: |
    Searches for Azure virtual machines via their registered DNS names.
  metadata:
    verified: true
    max-request: 1
  tags: cloud,cloud-enum,azure,bruteforce,enum

self-contained: true

variables:
  BaseDNS: "cloudapp.azure.com"
  regionname:
    - eastasia
    - southeastasia
    - centralus
    - eastus
    - eastus2
    - westus
    - northcentralus
    - southcentralus
    - northeurope
    - westeurope
    - japanwest
    - japaneast
    - brazilsouth
    - australiaeast
    - australiasoutheast
    - southindia
    - centralindia
    - westindia
    - canadacentral
    - canadaeast
    - uksouth
    - ukwest
    - westcentralus
    - westus2
    - koreacentral
    - koreasouth
    - francecentral
    - francesouth
    - australiacentral
    - australiacentral2
    - southafricanorth
    - southafricawest

dns:
  - name: "{{wordlist}}.{{regionname}}.{{BaseDNS}}"
    type: A
    class: inet

    recursion: true

    attack: batteringram

    matchers:
      - type: word
        part: answer
        words:
          - "IN\tA"
# digest: 4a0a00473045022100ad529d9d011c813ce7e0cb419a8440ca3f0bef3ca063b85560dbc678d6eb7056022022aa46f55179a7b72c6a02dcda0444e0aba98ddaa781c8118d39acd5cafdeaaf:922c64590222798bb761d5b6d8e72950