godaddy-parked-domain: GoDaddy Parked Domain - Subdomain Takeover

id: godaddy-parked-domain

info:
  name: GoDaddy Parked Domain - Subdomain Takeover
  author: ritikchaddha
  severity: medium
  description: |
    Detects potential subdomain takeover when a subdomain's CNAME points to a domain that is parked or listed for sale on GoDaddy. An attacker could purchase the target domain and gain full control over the subdomain, enabling phishing, cookie theft, or malicious content serving.
  reference:
    - https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover
    - https://cheatsheetseries.owasp.org/cheatsheets/Subdomain_Takeover_Prevention_Cheat_Sheet.html
  classification:
    cwe-id: CWE-404
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  metadata:
    max-request: 2
  tags: takeover,godaddy,parked-domain

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/lander"

    host-redirects: true
    max-redirects: 3
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "parking-lander"
          - "window.LANDER_SYSTEM"
        condition: and

      - type: dsl
        dsl:
          - '!contains(host,"godaddy.com")'
          - '!contains(host,"afternic.com")'
          - '!contains(host,"wsimg.com")'
        condition: and
# digest: 4a0a0047304502202a872909c35154c289112fc9c931f872c510aa11db6786ccacfc16d1b6bc9a1a022100ab7ae924923a3ac15753e444d4eadfd25ac997f71c51c621a4d0de9a97e12bd3:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.