id: txt-service-detect

info:
  name: DNS TXT Service - Detect
  author: rxerium
  severity: info
  description: |
    Finding the services companies use via their TXT records.
  reference:
    - https://www.abenezer.ca/blog/services-companies-use-txt-records
  metadata:
    verified: true
    max-request: 1
  tags: dns,txt

dns:
  - name: "{{FQDN}}"
    type: TXT

    matchers-condition: or
    matchers:
      - type: word
        name: "keybase"
        words:
          - "keybase-site-verification"

      - type: word
        name: "proton-mail"
        words:
          - "protonmail-verification"

      - type: word
        name: "webex"
        words:
          - "webexdomainverification"

      - type: word
        name: "apple"
        words:
          - "apple-domain-verification"

      - type: word
        name: "facebook"
        words:
          - "facebook-domain-verification"

      - type: word
        name: "autodesk"
        words:
          - "autodesk-domain-verification"

      - type: word
        name: "stripe"
        words:
          - "stripe-verification"

      - type: word
        name: "atlassian"
        words:
          - "atlassian-domain-verification"

      - type: word
        name: "adobe-sign"
        words:
          - "adobe-sign-verification"

      - type: word
        name: "zoho"
        words:
          - "zoho-verification"

      - type: word
        name: "have-i-been-pwned"
        words:
          - "have-i-been-pwned-verification"

      - type: word
        name: "knowbe4"
        words:
          - "knowbe4-site-verification"

      - type: word
        name: "jamf"
        words:
          - "jamf-site-verification"

      - type: word
        name: "parallels"
        words:
          - "parallels-domain-verification"

      - type: word
        name: "dropbox"
        words:
          - "dropbox-domain-verification"

      - type: word
        name: "vmware-cloud"
        words:
          - "vmware-cloud-verification"

      - type: word
        name: "canva"
        words:
          - "canva-site-verification"

      - type: word
        name: "mongodb"
        words:
          - "mongodb-site-verification"

      - type: word
        name: "slack"
        words:
          - "slack-domain-verification"

      - type: word
        name: "teamViewer"
        words:
          - "teamviewer-sso-verification"

      - type: word
        name: "bugcrowd"
        words:
          - "bugcrowd-verification"

      - type: word
        name: "cisco"
        words:
          - "cisco-site-verification"

      - type: word
        name: "palo-alto-networks"
        words:
          - "paloaltonetworks-site-verification"

      - type: word
        name: "twilio"
        words:
          - "twilio-domain-verification"

      - type: word
        name: "dell-technologies"
        words:
          - "dell-technologies-domain-verification"

      - type: word
        name: "1password"
        words:
          - "1password-site-verification"

      - type: word
        name: "duo"
        words:
          - "duo_sso_verification"

      - type: word
        name: "sophos"
        words:
          - "sophos-domain-verification"

      - type: word
        name: "pinterest"
        words:
          - "pinterest-site-verification"

      - type: word
        name: "citrix"
        words:
          - "citrix-verification-code"

      - type: word
        name: "zapier"
        words:
          - "zapier-domain-verification-challenge"

      - type: word
        name: "uber"
        words:
          - "uber-domain-verification"

      - type: word
        name: "zoom"
        words:
          - "zoom-domain-verification"

      - type: word
        name: "lastpass"
        words:
          - "lastpass-verification-code"

      - type: word
        name: "google-workspace"
        words:
          - "google-site-verification"

      - type: word
        name: "flexera"
        words:
          - "flexera-domain-verification"

      - type: word
        name: "yandex"
        words:
          - "yandex-verification"

      - type: word
        name: "calendly"
        words:
          - "calendly-site-verification"

      - type: word
        name: "docusign"
        words:
          - "docusign"

      - type: word
        name: "whimsical"
        words:
          - "whimsical"
# digest: 4a0a00473045022100b1a2ab86bb10ef6a55eaa2a6ec8a5adc22a05f003de6e5f6ef884921c4a66e12022054a8c73bec1723fa0637e65cf405f5a5091f6f257d743962dca0691ac639ce2a:922c64590222798bb761d5b6d8e72950