id: azure-vm-cloud-enum

info:
  name: Azure Virtual Machines - Cloud Enumeration
  author: initstring
  severity: info
  description: |
    Searches for Azure virtual machines via their registered DNS names.
  metadata:
    verified: true
  tags: cloud,cloud-enum,azure,fuzz,enum

self-contained: true

variables:
  BaseDNS: "cloudapp.azure.com"
  regionname:
    - eastasia
    - southeastasia
    - centralus
    - eastus
    - eastus2
    - westus
    - northcentralus
    - southcentralus
    - northeurope
    - westeurope
    - japanwest
    - japaneast
    - brazilsouth
    - australiaeast
    - australiasoutheast
    - southindia
    - centralindia
    - westindia
    - canadacentral
    - canadaeast
    - uksouth
    - ukwest
    - westcentralus
    - westus2
    - koreacentral
    - koreasouth
    - francecentral
    - francesouth
    - australiacentral
    - australiacentral2
    - southafricanorth
    - southafricawest

dns:
  - name: "{{wordlist}}.{{regionname}}.{{BaseDNS}}"
    type: A
    class: inet

    recursion: true

    attack: batteringram

    matchers:
      - type: word
        part: answer
        words:
          - "IN\tA"
# digest: 4b0a00483046022100f91b6621181f8a7317c1ffc179ec2b81e33c8dd0dd28cc4871b13ffbb794ce84022100e7424a97fab1f6b745d735e7dad8f13b08ad36732b24216ae2826611af634318:922c64590222798bb761d5b6d8e72950