mailgun-takeover: Mailgun Takeover Detection

id: mailgun-takeover

info:
  name: Mailgun Takeover Detection
  author: ProjectDiscoveryAI
  severity: medium
  description: |
    Detects potential domain takeover vulnerabilities associated with Mailgun by checking for specific CNAME records.
  reference:
    - https://github.com/EdOverflow/can-i-take-over-xyz/issues/451
    - https://aimasterprompt.medium.com/subdomain-takeover-on-mailgun-org-7d52ee2165e0
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cwe-id: CWE-404
  metadata:
    max-request: 1
  tags: dns,takeover,mailgun,discovery

http:
  - method: GET
    path:
      - "{{Hostname}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - Host != ip

      - type: status
        status:
          - 404

      - type: word
        part: cname
        words:
          - "mailgun.org"

    extractors:
      - type: dsl
        name: cname
        dsl:
          - resolve(Hostname, 'cname')
        internal: true
# digest: 4a0a00473045022100a8a9aa3b216d5b660485bf9564486f24ebefd9ec151ef1b2be45ad572f2892bd0220378893857c31bb30e0f05d44ac133b1b88dc28e3414b01a6a4fec9b3db226257:922c64590222798bb761d5b6d8e72950