id: flywheel-takeover

info:
  name: Flywheel Subdomain Takeover
  author: smaranchand
  severity: high
  reference:
    - https://smaranchand.com.np/2021/06/flywheel-subdomain-takeover
  metadata:
    max-request: 1
    verified: true
    shodan-query: http.html:"Flywheel"
  tags: takeover,flywheel

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "We're sorry, you've landed on a page that is hosted by Flywheel"
          - "<h1>Oops! That's not the site<br>you're looking&nbsp;for.</h1>"
        condition: and

      - type: word
        part: body
        words:
          - "We are sorry, you've landed on a page that is hosted by Flywheel"