Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update GitHub Pages Takeover Detection Templates to Reflect New GitHub Policy #10514

Open
adityaax opened this issue Aug 10, 2024 · 1 comment
Assignees
Labels
Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.

Comments

@adityaax
Copy link

Nuclei version: v3.3.0

Nuclei command: nuclei -l subDomains -t ~/nuclei-templates/http/takeovers -rl 40

Current Behavior: Nuclei currently indicates that a domain is vulnerable to GitHub Pages takeover.

Expected Behavior: However, after researching GitHub's updated policy, I found that the domain cannot be taken over due to the new requirement for domain verification through DNS TXT records.

Steps To Reproduce:

  1. Run nuclei (subDomains contain list of subdomains)-
    nuclei -l subDomains -t ~/nuclei-templates/http/takeovers -rl 40
  2. See the output-
    [github-takeover] [http] [high] https://giant.particle.io
  3. Go to https://github.com/EdOverflow/can-i-take-over-xyz and this will show 'edge case' for subdomain takeover throught Github pages.
  4. Go to Github > Create a public repository > Go to pages > Go to github actions > Add custom domain > Paste the domain you got from nuclei result
  5. See the error- You must verify your domain giant.particle.io before being able to use it. Check out https://docs.github.com/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages for more information.
  6. Review the document in reference section.

Anything else: https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages

@adityaax adityaax added the Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. label Aug 10, 2024
@ehsandeep ehsandeep transferred this issue from projectdiscovery/nuclei Aug 10, 2024
@princechaddha
Copy link
Member

Hello, the response time for this issue was longer than usual because the team was traveling for DEFCON. The team will respond to this issue shortly. Thank you for your contribution

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Projects
None yet
Development

No branches or pull requests

3 participants