blacklanternsecurity / baddns

Check subdomains for subdomain takeovers and other DNS tomfoolery
GNU General Public License v3.0
96 stars 5 forks source link

[SignatureBot] Add or update signature nucleitemplates_shopify-takeover.yml #346

Closed liquidsec closed 7 months ago

liquidsec commented 1 year ago

Add or update signature: nucleitemplates_shopify-takeover.yml

This PR adds or updates the follow signature:

identifiers:
  cnames:
  - type: word
    value: myshopify.com
  - type: word
    value: shopify.com
  ips: []
  nameservers: []
  not_cnames: []
matcher_rule:
  matchers:
  - dsl:
    - Host != ip
    type: dsl
  - condition: or
    part: body
    type: word
    words:
    - To finish setting up your new web address, go to your domain settings, click
      "Connect existing domain"
    - Sorry, this shop is currently unavailable.
  - condition: and
    part: body
    type: word
    words:
    - shop-not-found
  - condition: and
    dsl:
    - '!contains(host,"myshopify.com")'
    - '!contains(host,"shopify.com")'
    type: dsl
  matchers-condition: and
mode: http
service_name: shopify takeover detection
source: nucleitemplates
liquidsec commented 1 year ago

Test results:

Signature Pass: false :x: Error: No CNAMES passed random subdomain matcher validation

liquidsec commented 1 year ago

Test results:

Signature Pass: false :x:

Match Table:

Domain Match
myshopify.com false
shopify.com false
Error: **No CNAMES passed random subdomain matcher validation**
liquidsec commented 1 year ago

possibly not vulnerable anymore? needs research.

liquidsec commented 7 months ago

Test results:

Signature Pass: false :x:

Match Table:

Domain Match
myshopify.com false
shopify.com false
Error: **No CNAMES passed random subdomain matcher validation**
liquidsec commented 7 months ago

tests are failing. Looks like cloudflare is doing some hostname checking or something here, making this impossible now.

I'm not putting the block on here, just in case nuclei templates get updated i'd like the PR re-opened.