invalid fix for azure-takeover-detection.yaml

[savushkin-yauheni]

Hi team

Issue description:

Nuclei version: 3.2.8

Current template: https://github.com/projectdiscovery/nuclei-templates/blob/3e953023cac97aeab39a02b8f93d4e09624eac3c/dns/azure-takeover-detection.yaml doesn't work fine after last change.

For some reason dsl in dns works in incorrect way.

nuclei -t dns/azure-takeover-detection.yaml -target https://saviktestblabla.blob.core.windows.net --debug

No results.

But if we take previous version: https://github.com/projectdiscovery/nuclei-templates/blob/b38e8bbebc92d07818f11552e0bd39f963ddcfb9/dns/azure-takeover-detection.yaml everything is fine. It detected dns takeover.

[azure-takeover-detection:word-1] [dns] [high] saviktestblabla.blob.core.windows.net
[azure-takeover-detection:word-2] [dns] [high] saviktestblabla.blob.core.windows.net

Regards.

[ehsandeep]

@savushkin-yauheni I see that previous one produce false postive as it was matching in whole response, in this case it was getting matched with SOA response!

Expected match is to check in cname response which I don't see returning in your example.

$ dig cname saviktestblabla.blob.core.windows.net

; <<>> DiG 9.10.6 <<>> cname saviktestblabla.blob.core.windows.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19757
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;saviktestblabla.blob.core.windows.net. IN CNAME

;; AUTHORITY SECTION:
blob.core.windows.net.	60	IN	SOA	ns1-64.azure-dns.com. azuredns-hostmaster.microsoft.com. 1 3600 300 2419200 60

;; Query time: 55 msec
;; SERVER: 100.95.0.251#53(100.95.0.251)
;; WHEN: Thu May 30 17:12:59 IST 2024
;; MSG SIZE  rcvd: 152

[savushkin-yauheni]

Hi @ehsandeep ! Thanks for the checking.

But what is the point to check cname?
I can go to azure storage accounts and create saviktestblabla blob. And it means I own it. So takeover exists.

I think right now template check only hosts that have CNAME to such vulnerable microsoft domains. But after fix we lost the possibility to check such hosts themselves.

Maybe is it possible to combine logic?