Merge branch 'main' into new-signature-nucleitemplates_helpdocs-takeo…

…ver.yml
blacklanternsecurity · May 7, 2024 · e668ecd · e668ecd
2 parents b6639eb + 4cccd18
commit e668ecd
Show file tree

Hide file tree

Showing 4 changed files with 46 additions and 1 deletion.
diff --git a/baddns/modules/zonetransfer.py b/baddns/modules/zonetransfer.py
@@ -60,7 +60,7 @@ async def zone_transfer(self, nameserver, domain):
                 log.debug("dns.exception.FormError attempting zone transfer")
                 return False
             except Exception as e:
-                log.warning(f"Unknown error trying to perform zone transfer: [{e}]")
+                log.debug(f"Unknown error trying to perform zone transfer: [{e}]")
                 return False
             self.zone_nameservers.append(nameserver)
             self.parse_zone(zone)

diff --git a/baddns/signatures/nucleitemplates_squadcast-takeover.yml b/baddns/signatures/nucleitemplates_squadcast-takeover.yml
@@ -0,0 +1,22 @@
+identifiers:
+  cnames: []
+  ips: []
+  nameservers: []
+  not_cnames: []
+matcher_rule:
+  matchers:
+  - dsl:
+    - Host != ip
+    type: dsl
+  - condition: and
+    part: body
+    type: word
+    words:
+    - "There doesn\u2019t seem to be an active status page associated with this URL."
+    - Please check the URL and try again.
+  - status: 404
+    type: status
+  matchers-condition: and
+mode: http
+service_name: Squadcast Takeover Detection
+source: nucleitemplates
diff --git a/baddns/signatures/nucleitemplates_uptime-takeover.yml b/baddns/signatures/nucleitemplates_uptime-takeover.yml
@@ -0,0 +1,21 @@
+identifiers:
+  cnames: []
+  ips: []
+  nameservers: []
+  not_cnames: []
+matcher_rule:
+  matchers:
+  - dsl:
+    - Host != ip
+    type: dsl
+  - condition: and
+    part: body
+    type: word
+    words:
+    - <html><body>You are being <a href="https://uptime.betterstack.com">redirected</a>.</body></html>
+  - status: 302
+    type: status
+  matchers-condition: and
+mode: http
+service_name: Uptime Takeover Detection
+source: nucleitemplates
diff --git a/baddns/signatures/signature_history.txt b/baddns/signatures/signature_history.txt
@@ -102,3 +102,5 @@ e99f19fee1bf0128e1d15aa562fbe660780674b3189727ec9ceb9815222e94c6 #nucleitemplate
 2dd9264885df0d12e7e7ae3d95a83c67e2595753e310453c430013fecfaa0602 #dnsreaper_smartjobboard.yml
 700612eb0f8776b2732d00214159b6db94aabebc60127c251c54ae836b551cd6 #dnsreaper_teamwork.yml
 9425a6cfecf6121f33769e79dc46f5c3c0b3c78861c72a856fef2f81c9abf9e0 #nucleitemplates_helpdocs-takeover.yml
+22b21533c10e5859223004c0d65bc722b393e1d752c9fa7b27dc04ba315999df #nucleitemplates_uptime-takeover.yml
+e3a452987e0aab4f6c387dd89dc1a042590a14555274a564d5d6e5f9dfc691c9 #nucleitemplates_squadcast-takeover.yml