id: can-i-take-over-dns

info:
  name: Can I Take Over DNS - Fingerprint
  author: pdteam
  severity: info
  tags: dns,ns,takeover
  reference: https://github.com/indianajson/can-i-take-over-dns

dns:
  - name: "{{FQDN}}"
    type: NS
    class: inet
    recursion: true
    retries: 3

    matchers-condition: or
    matchers:
      - type: word
        name: 000domains
        condition: or
        words:
          - "ns1.000domains.com"
          - "ns2.000domains.com"
          - "fwns1.000domains.com"
          - "fwns2.000domains.com"

      - type: word
        name: azure
        condition: or
        words:
          - ".azure-dns.com"
          - ".azure-dns.net"
          - ".azure-dns.org"
          - ".azure-dns.info"

      - type: word
        name: bizland
        condition: or
        words:
          - "ns1.bizland.com"
          - "ns2.bizland.com"

      - type: word
        name: digitalocean
        condition: or
        words:
          - "ns1.digitalocean.com"
          - "ns2.digitalocean.com"
          - "ns2.digitalocean.com"

      - type: word
        name: dnsmadeeasy
        words:
          - ".dnsmadeeasy.com"

      - type: word
        name: dnsimple
        condition: or
        words:
          - "ns1.dnsimple.com"
          - "ns2.dnsimple.com"
          - "ns3.dnsimple.com"
          - "ns4.dnsimple.com"

      - type: word
        name: domain
        condition: or
        words:
          - "ns1.domain.com"
          - "ns2.domain.com"

      - type: word
        name: dotster
        condition: or
        words:
          - "ns1.dotster.com"
          - "ns2.dotster.com"

      - type: word
        name: easydns
        condition: or
        words:
          - "dns1.easydns.com"
          - "dns2.easydns.com"
          - "dns3.easydns.com"
          - "dns4.easydns.com"

      - type: word
        name: googledomains
        words:
          - ".googledomains.com"

      - type: word
        name: hurricane-electric
        condition: or
        words:
          - "ns1.he.net"
          - "ns2.he.net"
          - "ns3.he.net"
          - "ns4.he.net"
          - "ns5.he.net"

      - type: word
        name: linode
        condition: or
        words:
          - "ns1.linode.com"
          - "ns1.linode.com"

      - type: word
        name: mydomain
        condition: or
        words:
          - "ns1.mydomain.com"
          - "ns2.mydomain.com"

      - type: word
        name: name
        words:
          - ".name.com"

      - type: word
        name: nsone
        words:
          - ".nsone.net"

      - type: word
        name: tierranet
        condition: or
        words:
          - "ns1.domaindiscover.com"
          - "ns2.domaindiscover.com"

      - type: word
        name: yahoo
        condition: or
        words:
          - "yns1.yahoo.com"
          - "yns2.yahoo.com"