id: flywheel-takeover

info:
  name: Flywheel Subdomain Takeover
  author: smaranchand
  severity: high
  description: Flywheel takeover was detected.
  reference:
    - https://smaranchand.com.np/2021/06/flywheel-subdomain-takeover
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"Flywheel"
  tags: takeover,flywheel

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "We're sorry, you've landed on a page that is hosted by Flywheel"
          - "<h1>Oops! That's not the site<br>you're looking&nbsp;for.</h1>"
        condition: and

      - type: word
        part: body
        words:
          - "We are sorry, you've landed on a page that is hosted by Flywheel"
# digest: 4a0a00473045022100c65c64d3a7226e36ae3cf134895cc98fb03a04cdfc9dc431eeb61696a096dd380220464ee36598416ac00838699b717d73b587432b2ed738fe71b2b5da09cc272ab6:922c64590222798bb761d5b6d8e72950