nuclei-templates/dns/azure-takeover-detection.yaml

47 lines
1.2 KiB
YAML

id: azure-takeover-detection
info:
name: Azure takeover detection
author: pdteam
severity: high
tags: dns,takeover
# Update the list with more CNAMEs related to azure
# You need to claim the CNAME in Azure portal (https://portal.azure.com) to confirm the takeover.
# Reference:- https://godiego.tech/posts/STO/, kudos to @secfaults for sharing process details.
# Do not report this without claiming the CNAME.
dns:
- name: "{{FQDN}}"
type: A
class: inet
recursion: true
retries: 3
matchers-condition: and
matchers:
- type: word
words:
- "azure-api.net"
- "azure-mobile.net"
- "azurecontainer.io"
- "azurecr.io"
- "azuredatalakestore.net"
- "azureedge.net"
- "azurefd.net"
- "azurehdinsight.net"
- "azurewebsites.net"
- "azurewebsites.windows.net"
- "blob.core.windows.net"
- "cloudapp.azure.com"
- "cloudapp.net"
- "database.windows.net"
- "redis.cache.windows.net"
- "search.windows.net"
- "servicebus.windows.net"
- "trafficmanager.net"
- "visualstudio.com"
- type: word
words:
- "NXDOMAIN"