nuclei-templates/dns/detect-dangling-cname.yaml

39 lines
1.1 KiB
YAML

id: detect-dangling-cname
info:
name: CNAME Detect Dangling
author: pdteam,nytr0gen
severity: info
description: A CNAME detect dangling condition was discovered. Most commonly this relates to failing to remove records from the zone once they are no longer needed.
reference:
- https://securitytrails.com/blog/subdomain-takeover-tips
- https://nominetcyber.com/dangling-dns-is-no-laughing-matter/
- https://nabeelxy.medium.com/dangling-dns-records-are-a-real-vulnerability-361f2a29d37f
- https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
classification:
cwe-id: CWE-200
metadata:
max-request: 1
tags: dns,takeover
dns:
- name: "{{FQDN}}"
type: A
matchers-condition: and
matchers:
- type: word
words:
- "NXDOMAIN"
- type: regex
regex:
- "IN\tCNAME\\t(.+)$"
extractors:
- type: dsl
dsl:
- cname
# digest: 4a0a00473045022100ec9f942301604384f1ef3a2f9987cd29d437e35e882b86ed15127558bfe7ff7302203de45942e5824f5074f3d30b9d3323394b8fbd95c30e519c99901086ad64eecc:922c64590222798bb761d5b6d8e72950