id: clever-takeover

info:
  name: Clever Cloud - Subdomain Takeover Detection
  author: supr4s
  severity: high
  description: Clever Cloud subdomain takeover was detected.
  reference:
    - https://supras.io/new-subdomain-takeover-case-clever-cloud/
  metadata:
    max-request: 1
  tags: takeover

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - Host != ip

      - type: word
        part: body
        words:
          - "The application you're trying to access doesn't seem to exist"
          - "support@clever-cloud.com"
        condition: and

    extractors:
      - type: dsl
        dsl:
          - cname
# digest: 4a0a0047304502205583c47d8a30c20d7ff49a6042467de30b1e7b81a801dbcb21107c1d62cb5248022100e8d1b4f47827afc48ea77b3ea8ee6d125cb90f086682f861aa9f00cf7e6c621d:922c64590222798bb761d5b6d8e72950