search

projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.
https://github.com/projectdiscovery/nuclei
MIT License
9.07k stars 2.59k forks source link

invalid fix for azure-takeover-detection.yaml #9940

Open savushkin-yauheni opened 4 months ago

savushkin-yauheni commented 4 months ago

Hi team

Issue description:

Nuclei version: 3.2.8

Current template: https://github.com/projectdiscovery/nuclei-templates/blob/3e953023cac97aeab39a02b8f93d4e09624eac3c/dns/azure-takeover-detection.yaml doesn't work fine after last change.

For some reason dsl in dns works in incorrect way.

nuclei -t dns/azure-takeover-detection.yaml -target https://saviktestblabla.blob.core.windows.net --debug

No results.

But if we take previous version: https://github.com/projectdiscovery/nuclei-templates/blob/b38e8bbebc92d07818f11552e0bd39f963ddcfb9/dns/azure-takeover-detection.yaml everything is fine. It detected dns takeover.

[azure-takeover-detection:word-1] [dns] [high] saviktestblabla.blob.core.windows.net
[azure-takeover-detection:word-2] [dns] [high] saviktestblabla.blob.core.windows.net

Regards.

ehsandeep commented 4 months ago

@savushkin-yauheni I see that previous one produce false postive as it was matching in whole response, in this case it was getting matched with SOA response!

Expected match is to check in cname response which I don't see returning in your example.

$ dig cname saviktestblabla.blob.core.windows.net

; <<>> DiG 9.10.6 <<>> cname saviktestblabla.blob.core.windows.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19757
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;saviktestblabla.blob.core.windows.net. IN CNAME

;; AUTHORITY SECTION:
blob.core.windows.net.  60  IN  SOA ns1-64.azure-dns.com. azuredns-hostmaster.microsoft.com. 1 3600 300 2419200 60

;; Query time: 55 msec
;; SERVER: 100.95.0.251#53(100.95.0.251)
;; WHEN: Thu May 30 17:12:59 IST 2024
;; MSG SIZE  rcvd: 152
savushkin-yauheni commented 4 months ago

Hi @ehsandeep ! Thanks for the checking.

But what is the point to check cname? I can go to azure storage accounts and create saviktestblabla blob. And it means I own it. So takeover exists.

I think right now template check only hosts that have CNAME to such vulnerable microsoft domains. But after fix we lost the possibility to check such hosts themselves.

Maybe is it possible to combine logic?