search

blacklanternsecurity / baddns

Check subdomains for subdomain takeovers and other DNS tomfoolery
GNU General Public License v3.0
92 stars 5 forks source link

resource hijack module #384

Closed liquidsec closed 10 months ago

liquidsec commented 11 months ago

Add a module that would parse a page for links. In particular, we want javascript/css that is being included into the page.

We are looking for content that doesn't load...

Then subject the domain to the various signatures, both by looking at the domain name itself, and (if it loads) the http-based signatures

Any matches would be reported differently, basically referencing the resource that could be hijacked

subtypes could be:

-Hijackable Javascript Resource -Hijackable CSS Resource -Hijackable CORS trust -Hijackable CSP trust

etc

liquidsec commented 10 months ago

initial version added in https://github.com/blacklanternsecurity/baddns/pull/387