id: clever-takeover

info:
  name: Clever Cloud - Subdomain Takeover Detection
  author: supr4s
  severity: high
  description: Clever Cloud subdomain takeover was detected.
  reference:
    - https://supras.io/new-subdomain-takeover-case-clever-cloud/
  metadata:
    max-request: 1
  tags: takeover

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - Host != ip

      - type: word
        part: body
        words:
          - "The application you're trying to access doesn't seem to exist"
          - "support@clever-cloud.com"
        condition: and

# digest: 4a0a0047304502200a5e85c22f866e219ce404626a6c67addb67e89b5b92e10d9fd83b434e7336c3022100f862c3ca1bb2fb5467e28896d545cd1d2d17ef6fe6d9027fc95226caba6b5ca4:922c64590222798bb761d5b6d8e72950