fingerprint-mcp 0.1.0

package/dist/data/smtp-signatures.js

@@ -0,0 +1,350 @@
+// smtp-signatures.ts — SMTP banner and EHLO extension patterns for mail server fingerprinting
+// Used to identify mail transfer agents, hosted email providers, and relay services.
+export const SMTP_SIGNATURES = [
+    // ── Postfix ────────────────────────────────────────────────────────────
+    {
+        name: "Postfix",
+        bannerPatterns: [
+            "220\\s+.*\\s+ESMTP\\s+Postfix",
+            "220\\s+.*Postfix\\s*\\(",
+            "220\\s+.*ESMTP\\s+Postfix\\s+\\(.*?\\)",
+        ],
+        ehloExtensions: [
+            "PIPELINING",
+            "SIZE",
+            "VRFY",
+            "ETRN",
+            "STARTTLS",
+            "ENHANCEDSTATUSCODES",
+            "8BITMIME",
+            "DSN",
+            "SMTPUTF8",
+            "CHUNKING",
+        ],
+        category: "mta",
+    },
+    // ── Sendmail ───────────────────────────────────────────────────────────
+    {
+        name: "Sendmail",
+        bannerPatterns: [
+            "220\\s+.*Sendmail\\s+[\\d.]+\\/",
+            "220\\s+.*ESMTP\\s+Sendmail",
+            "220\\s+.*Sendmail\\s+ready",
+        ],
+        ehloExtensions: [
+            "ENHANCEDSTATUSCODES",
+            "PIPELINING",
+            "8BITMIME",
+            "SIZE",
+            "DSN",
+            "ETRN",
+            "STARTTLS",
+            "DELIVERBY",
+        ],
+        category: "mta",
+    },
+    // ── Exim ───────────────────────────────────────────────────────────────
+    {
+        name: "Exim",
+        bannerPatterns: [
+            "220\\s+.*ESMTP\\s+Exim\\s+[\\d.]+",
+            "220\\s+.*Exim\\s+[\\d.]+\\s+.*ready",
+            "220-.*Exim",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "PIPELINING",
+            "STARTTLS",
+            "PRDR",
+            "CHUNKING",
+        ],
+        category: "mta",
+    },
+    // ── Microsoft Exchange ─────────────────────────────────────────────────
+    {
+        name: "Microsoft Exchange",
+        bannerPatterns: [
+            "220\\s+.*Microsoft\\s+ESMTP\\s+MAIL\\s+Service",
+            "220\\s+.*Microsoft\\s+Exchange",
+            "220\\s+.*Exchange\\s+Server",
+            "220\\s+.*Microsoft\\s+SMTP",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "PIPELINING",
+            "DSN",
+            "ENHANCEDSTATUSCODES",
+            "STARTTLS",
+            "8BITMIME",
+            "BINARYMIME",
+            "CHUNKING",
+            "XEXCH50",
+            "XRDST",
+            "X-EXPS",
+            "X-ANONYMOUSTLS",
+        ],
+        category: "mta",
+    },
+    // ── Gmail / Google ─────────────────────────────────────────────────────
+    {
+        name: "Gmail",
+        bannerPatterns: [
+            "220\\s+mx\\.google\\.com\\s+ESMTP",
+            "220\\s+smtp\\.gmail\\.com\\s+ESMTP",
+            "220\\s+smtp\\.google\\.com\\s+ESMTP",
+            "220\\s+.*\\.google\\.com\\s+ESMTP\\s+[a-z0-9]+\\.[0-9]+\\s*-\\s*gsmtp",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "ENHANCEDSTATUSCODES",
+            "PIPELINING",
+            "CHUNKING",
+            "SMTPUTF8",
+        ],
+        category: "provider",
+    },
+    // ── Yahoo Mail ─────────────────────────────────────────────────────────
+    {
+        name: "Yahoo Mail",
+        bannerPatterns: [
+            "220\\s+mta.*\\.am0\\.yahoodns\\.net\\s+ESMTP",
+            "220\\s+.*\\.yahoo\\.com\\s+ESMTP",
+            "220\\s+.*Yahoo\\s+ESMTP",
+            "220\\s+smtp\\.mail\\.yahoo\\.com",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "PIPELINING",
+            "STARTTLS",
+        ],
+        category: "provider",
+    },
+    // ── ProtonMail ─────────────────────────────────────────────────────────
+    {
+        name: "ProtonMail",
+        bannerPatterns: [
+            "220\\s+mail\\.protonmail\\.ch\\s+ESMTP",
+            "220\\s+.*\\.protonmail\\.ch\\s+ESMTP",
+            "220\\s+.*Proton Mail",
+            "220\\s+mail\\.proton\\.me\\s+ESMTP",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "ENHANCEDSTATUSCODES",
+            "CHUNKING",
+        ],
+        category: "provider",
+    },
+    // ── Amazon SES ─────────────────────────────────────────────────────────
+    {
+        name: "Amazon SES",
+        bannerPatterns: [
+            "220\\s+email-smtp\\..*\\.amazonaws\\.com\\s+ESMTP",
+            "220\\s+.*\\.smtp\\.amazonaws\\.com",
+            "220\\s+.*Amazon\\s+SES",
+            "220\\s+inbound-smtp\\..*\\.amazonaws\\.com",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "PIPELINING",
+        ],
+        category: "relay",
+    },
+    // ── Outlook.com / Office 365 ───────────────────────────────────────────
+    {
+        name: "Outlook.com",
+        bannerPatterns: [
+            "220\\s+.*\\.mail\\.protection\\.outlook\\.com\\s+Microsoft\\s+ESMTP",
+            "220\\s+.*\\.outlook\\.com\\s+ESMTP",
+            "220\\s+.*\\.hotmail\\.com\\s+",
+            "220\\s+.*\\.olc\\.protection\\.outlook\\.com",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "PIPELINING",
+            "DSN",
+            "ENHANCEDSTATUSCODES",
+            "STARTTLS",
+            "8BITMIME",
+            "BINARYMIME",
+            "CHUNKING",
+            "SMTPUTF8",
+        ],
+        category: "provider",
+    },
+    // ── Zimbra ─────────────────────────────────────────────────────────────
+    {
+        name: "Zimbra",
+        bannerPatterns: [
+            "220\\s+.*Zimbra\\s+ESMTP",
+            "220\\s+.*ESMTP\\s+Zimbra",
+            "220\\s+.*Zimbra\\s+[\\d.]+",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "ENHANCEDSTATUSCODES",
+            "PIPELINING",
+            "CHUNKING",
+            "AUTH LOGIN PLAIN",
+        ],
+        category: "mta",
+    },
+    // ── hMailServer ────────────────────────────────────────────────────────
+    {
+        name: "hMailServer",
+        bannerPatterns: [
+            "220\\s+.*hMailServer\\s+[\\d.]+",
+            "220\\s+.*ESMTP\\s+hMailServer",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "AUTH LOGIN PLAIN",
+        ],
+        category: "mta",
+    },
+    // ── Dovecot LMTP ───────────────────────────────────────────────────────
+    {
+        name: "Dovecot",
+        bannerPatterns: [
+            "220\\s+.*Dovecot\\s+ready",
+            "220\\s+.*Dovecot\\s+LMTP",
+            "220\\s+.*LMTP\\s+Dovecot",
+        ],
+        ehloExtensions: [
+            "8BITMIME",
+            "ENHANCEDSTATUSCODES",
+            "PIPELINING",
+            "CHUNKING",
+            "STARTTLS",
+        ],
+        category: "mta",
+    },
+    // ── OpenSMTPD ──────────────────────────────────────────────────────────
+    {
+        name: "OpenSMTPD",
+        bannerPatterns: [
+            "220\\s+.*ESMTP\\s+OpenSMTPD",
+            "220\\s+.*OpenSMTPD",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "ENHANCEDSTATUSCODES",
+            "STARTTLS",
+            "DSN",
+            "AUTH PLAIN LOGIN",
+        ],
+        category: "mta",
+    },
+    // ── Haraka ─────────────────────────────────────────────────────────────
+    {
+        name: "Haraka",
+        bannerPatterns: [
+            "220\\s+.*ESMTP\\s+Haraka\\s+[\\d.]+",
+            "220\\s+.*Haraka\\s+ready",
+        ],
+        ehloExtensions: [
+            "PIPELINING",
+            "8BITMIME",
+            "SIZE",
+            "STARTTLS",
+        ],
+        category: "mta",
+    },
+    // ── MailEnable ─────────────────────────────────────────────────────────
+    {
+        name: "MailEnable",
+        bannerPatterns: [
+            "220\\s+.*MailEnable",
+            "220\\s+.*ESMTP\\s+MailEnable",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "AUTH LOGIN",
+        ],
+        category: "mta",
+    },
+    // ── Mailcow (Dockerized) ──────────────────────────────────────────────
+    {
+        name: "Mailcow",
+        bannerPatterns: [
+            "220\\s+.*ESMTP\\s+Postfix\\s+\\(Mailcow\\)",
+            "220\\s+.*mailcow",
+        ],
+        ehloExtensions: [
+            "PIPELINING",
+            "SIZE",
+            "ETRN",
+            "STARTTLS",
+            "ENHANCEDSTATUSCODES",
+            "8BITMIME",
+            "DSN",
+            "CHUNKING",
+        ],
+        category: "mta",
+    },
+    // ── SendGrid ───────────────────────────────────────────────────────────
+    {
+        name: "SendGrid",
+        bannerPatterns: [
+            "220\\s+.*\\.sendgrid\\.net\\s+ESMTP",
+            "220\\s+.*SendGrid",
+            "220\\s+smtp\\.sendgrid\\.net",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "PIPELINING",
+            "AUTH PLAIN LOGIN",
+        ],
+        category: "relay",
+    },
+    // ── Mailgun ────────────────────────────────────────────────────────────
+    {
+        name: "Mailgun",
+        bannerPatterns: [
+            "220\\s+.*\\.mailgun\\.org\\s+ESMTP",
+            "220\\s+smtp\\.mailgun\\.org",
+            "220\\s+.*Mailgun\\s+Influx",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "AUTH PLAIN LOGIN",
+        ],
+        category: "relay",
+    },
+    // ── Fastmail ───────────────────────────────────────────────────────────
+    {
+        name: "Fastmail",
+        bannerPatterns: [
+            "220\\s+.*\\.messagingengine\\.com\\s+ESMTP",
+            "220\\s+.*\\.fastmail\\.com\\s+ESMTP",
+        ],
+        ehloExtensions: [
+            "SIZE",
+            "8BITMIME",
+            "STARTTLS",
+            "ENHANCEDSTATUSCODES",
+            "PIPELINING",
+        ],
+        category: "provider",
+    },
+];
+//# sourceMappingURL=smtp-signatures.js.map

package/dist/data/smtp-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-signatures.js","sourceRoot":"","sources":["../../src/data/smtp-signatures.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,qFAAqF;AAarF,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,0EAA0E;IAC1E;QACE,IAAI,EAAE,SAAS;QACf,cAAc,EAAE;YACd,+BAA+B;YAC/B,yBAAyB;YACzB,wCAAwC;SACzC;QACD,cAAc,EAAE;YACd,YAAY;YACZ,MAAM;YACN,MAAM;YACN,MAAM;YACN,UAAU;YACV,qBAAqB;YACrB,UAAU;YACV,KAAK;YACL,UAAU;YACV,UAAU;SACX;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,UAAU;QAChB,cAAc,EAAE;YACd,iCAAiC;YACjC,4BAA4B;YAC5B,4BAA4B;SAC7B;QACD,cAAc,EAAE;YACd,qBAAqB;YACrB,YAAY;YACZ,UAAU;YACV,MAAM;YACN,KAAK;YACL,MAAM;YACN,UAAU;YACV,WAAW;SACZ;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,MAAM;QACZ,cAAc,EAAE;YACd,mCAAmC;YACnC,qCAAqC;YACrC,YAAY;SACb;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,YAAY;YACZ,UAAU;YACV,MAAM;YACN,UAAU;SACX;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,oBAAoB;QAC1B,cAAc,EAAE;YACd,gDAAgD;YAChD,gCAAgC;YAChC,6BAA6B;YAC7B,4BAA4B;SAC7B;QACD,cAAc,EAAE;YACd,MAAM;YACN,YAAY;YACZ,KAAK;YACL,qBAAqB;YACrB,UAAU;YACV,UAAU;YACV,YAAY;YACZ,UAAU;YACV,SAAS;YACT,OAAO;YACP,QAAQ;YACR,gBAAgB;SACjB;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,OAAO;QACb,cAAc,EAAE;YACd,mCAAmC;YACnC,oCAAoC;YACpC,qCAAqC;YACrC,uEAAuE;SACxE;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,qBAAqB;YACrB,YAAY;YACZ,UAAU;YACV,UAAU;SACX;QACD,QAAQ,EAAE,UAAU;KACrB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,YAAY;QAClB,cAAc,EAAE;YACd,8CAA8C;YAC9C,kCAAkC;YAClC,yBAAyB;YACzB,kCAAkC;SACnC;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,YAAY;YACZ,UAAU;SACX;QACD,QAAQ,EAAE,UAAU;KACrB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,YAAY;QAClB,cAAc,EAAE;YACd,wCAAwC;YACxC,sCAAsC;YACtC,sBAAsB;YACtB,oCAAoC;SACrC;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,qBAAqB;YACrB,UAAU;SACX;QACD,QAAQ,EAAE,UAAU;KACrB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,YAAY;QAClB,cAAc,EAAE;YACd,mDAAmD;YACnD,oCAAoC;YACpC,wBAAwB;YACxB,4CAA4C;SAC7C;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,YAAY;SACb;QACD,QAAQ,EAAE,OAAO;KAClB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,aAAa;QACnB,cAAc,EAAE;YACd,qEAAqE;YACrE,oCAAoC;YACpC,+BAA+B;YAC/B,8CAA8C;SAC/C;QACD,cAAc,EAAE;YACd,MAAM;YACN,YAAY;YACZ,KAAK;YACL,qBAAqB;YACrB,UAAU;YACV,UAAU;YACV,YAAY;YACZ,UAAU;YACV,UAAU;SACX;QACD,QAAQ,EAAE,UAAU;KACrB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,QAAQ;QACd,cAAc,EAAE;YACd,0BAA0B;YAC1B,0BAA0B;YAC1B,4BAA4B;SAC7B;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,qBAAqB;YACrB,YAAY;YACZ,UAAU;YACV,kBAAkB;SACnB;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,aAAa;QACnB,cAAc,EAAE;YACd,iCAAiC;YACjC,+BAA+B;SAChC;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,kBAAkB;SACnB;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,SAAS;QACf,cAAc,EAAE;YACd,2BAA2B;YAC3B,0BAA0B;YAC1B,0BAA0B;SAC3B;QACD,cAAc,EAAE;YACd,UAAU;YACV,qBAAqB;YACrB,YAAY;YACZ,UAAU;YACV,UAAU;SACX;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE;YACd,6BAA6B;YAC7B,oBAAoB;SACrB;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,qBAAqB;YACrB,UAAU;YACV,KAAK;YACL,kBAAkB;SACnB;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,QAAQ;QACd,cAAc,EAAE;YACd,qCAAqC;YACrC,0BAA0B;SAC3B;QACD,cAAc,EAAE;YACd,YAAY;YACZ,UAAU;YACV,MAAM;YACN,UAAU;SACX;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,YAAY;QAClB,cAAc,EAAE;YACd,qBAAqB;YACrB,8BAA8B;SAC/B;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,YAAY;SACb;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,yEAAyE;IACzE;QACE,IAAI,EAAE,SAAS;QACf,cAAc,EAAE;YACd,4CAA4C;YAC5C,kBAAkB;SACnB;QACD,cAAc,EAAE;YACd,YAAY;YACZ,MAAM;YACN,MAAM;YACN,UAAU;YACV,qBAAqB;YACrB,UAAU;YACV,KAAK;YACL,UAAU;SACX;QACD,QAAQ,EAAE,KAAK;KAChB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,UAAU;QAChB,cAAc,EAAE;YACd,qCAAqC;YACrC,mBAAmB;YACnB,8BAA8B;SAC/B;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,YAAY;YACZ,kBAAkB;SACnB;QACD,QAAQ,EAAE,OAAO;KAClB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,SAAS;QACf,cAAc,EAAE;YACd,oCAAoC;YACpC,6BAA6B;YAC7B,4BAA4B;SAC7B;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,kBAAkB;SACnB;QACD,QAAQ,EAAE,OAAO;KAClB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,UAAU;QAChB,cAAc,EAAE;YACd,4CAA4C;YAC5C,qCAAqC;SACtC;QACD,cAAc,EAAE;YACd,MAAM;YACN,UAAU;YACV,UAAU;YACV,qBAAqB;YACrB,YAAY;SACb;QACD,QAAQ,EAAE,UAAU;KACrB;CACF,CAAC"}

package/dist/data/takeover-patterns.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Subdomain takeover detection patterns.
+ *
+ * When a DNS CNAME record points to a third-party service (e.g., Heroku,
+ * GitHub Pages, S3) but the resource on that service has been deleted or never
+ * provisioned, an attacker can register the same resource and serve arbitrary
+ * content on the victim's subdomain.
+ *
+ * Each entry contains CNAME target regex patterns and response fingerprints
+ * (body text, HTTP status, headers) that confirm the resource is unclaimed.
+ *
+ * References:
+ *  - https://github.com/EdOverflow/can-i-take-over-xyz
+ *  - https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover
+ */
+/** A subdomain takeover detection entry for a specific hosting service. */
+export interface TakeoverPattern {
+    /** Name of the hosting / SaaS service */
+    service: string;
+    /** Regex patterns that match the CNAME target hostname */
+    cnamePatterns: string[];
+    /** Response fingerprints that confirm the resource is unclaimed */
+    fingerprints: {
+        /** Body content patterns (regex) indicating an unclaimed resource */
+        body?: string[];
+        /** Expected HTTP status code for unclaimed resources */
+        status?: number;
+        /** Header patterns (name → regex) on the error response */
+        headers?: Record<string, string>;
+    };
+    /** Risk severity — high means trivially exploitable with no auth */
+    severity: "high" | "medium" | "low";
+    /** Reference URL for takeover documentation / proof-of-concept */
+    documentation?: string;
+}
+export declare const TAKEOVER_PATTERNS: TakeoverPattern[];
+//# sourceMappingURL=takeover-patterns.d.ts.map

package/dist/data/takeover-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"takeover-patterns.d.ts","sourceRoot":"","sources":["../../src/data/takeover-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,mEAAmE;IACnE,YAAY,EAAE;QACZ,qEAAqE;QACrE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,wDAAwD;QACxD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpC,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,iBAAiB,EAAE,eAAe,EAqP9C,CAAC"}

package/dist/data/takeover-patterns.js

@@ -0,0 +1,249 @@
+/**
+ * Subdomain takeover detection patterns.
+ *
+ * When a DNS CNAME record points to a third-party service (e.g., Heroku,
+ * GitHub Pages, S3) but the resource on that service has been deleted or never
+ * provisioned, an attacker can register the same resource and serve arbitrary
+ * content on the victim's subdomain.
+ *
+ * Each entry contains CNAME target regex patterns and response fingerprints
+ * (body text, HTTP status, headers) that confirm the resource is unclaimed.
+ *
+ * References:
+ *  - https://github.com/EdOverflow/can-i-take-over-xyz
+ *  - https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover
+ */
+export const TAKEOVER_PATTERNS = [
+    // ──────────────────────────────────────────────────
+    // PaaS / Hosting
+    // ──────────────────────────────────────────────────
+    {
+        service: "Heroku",
+        cnamePatterns: ["\\.herokuapp\\.com$", "\\.herokussl\\.com$"],
+        fingerprints: {
+            body: ["No such app", "no-hierarchical-app-detected"],
+            status: 404,
+            headers: { server: "^heroku-router$" },
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#heroku",
+    },
+    {
+        service: "GitHub Pages",
+        cnamePatterns: ["\\.github\\.io$"],
+        fingerprints: {
+            body: [
+                "There isn't a GitHub Pages site here",
+                "For root URLs \\(like http://example\\.com/\\) you must provide an index\\.html file",
+            ],
+            status: 404,
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#github-pages",
+    },
+    {
+        service: "AWS S3",
+        cnamePatterns: [
+            "\\.s3\\.amazonaws\\.com$",
+            "\\.s3-website[-.].+\\.amazonaws\\.com$",
+            "\\.s3\\..+\\.amazonaws\\.com$",
+        ],
+        fingerprints: {
+            body: ["NoSuchBucket", "The specified bucket does not exist"],
+            status: 404,
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#aws-s3",
+    },
+    {
+        service: "Microsoft Azure",
+        cnamePatterns: [
+            "\\.azurewebsites\\.net$",
+            "\\.cloudapp\\.azure\\.com$",
+            "\\.azure-api\\.net$",
+            "\\.azurefd\\.net$",
+            "\\.trafficmanager\\.net$",
+        ],
+        fingerprints: {
+            body: ["404 Web Site not found", "Web App - Pair Not Found"],
+            status: 404,
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#azure",
+    },
+    {
+        service: "Shopify",
+        cnamePatterns: ["shops\\.myshopify\\.com$"],
+        fingerprints: {
+            body: [
+                "Sorry, this shop is currently unavailable",
+                "Only one step left!",
+            ],
+            status: 404,
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#shopify",
+    },
+    {
+        service: "Fastly",
+        cnamePatterns: ["\\.fastly\\.net$", "\\.fastlylb\\.net$"],
+        fingerprints: {
+            body: ["Fastly error: unknown domain"],
+            status: 500,
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#fastly",
+    },
+    {
+        service: "Ghost",
+        cnamePatterns: ["\\.ghost\\.io$"],
+        fingerprints: {
+            body: ["The thing you were looking for is no longer here"],
+            status: 404,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#ghost",
+    },
+    {
+        service: "Pantheon",
+        cnamePatterns: ["\\.pantheonsite\\.io$", "\\.pantheon\\.io$"],
+        fingerprints: {
+            body: [
+                "404 error unknown site",
+                "The gods are wise, but do not know of the site",
+            ],
+            status: 404,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#pantheon",
+    },
+    {
+        service: "Tumblr",
+        cnamePatterns: ["\\.tumblr\\.com$", "domains\\.tumblr\\.com$"],
+        fingerprints: {
+            body: [
+                "There's nothing here",
+                "Whatever you were looking for doesn't currently exist",
+            ],
+            status: 404,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#tumblr",
+    },
+    {
+        service: "Zendesk",
+        cnamePatterns: ["\\.zendesk\\.com$"],
+        fingerprints: {
+            body: ["Help Center Closed", "This help center no longer exists"],
+            status: 404,
+            headers: { "x-zendesk-request-id": "." },
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#zendesk",
+    },
+    // ──────────────────────────────────────────────────
+    // Static Hosting / Portfolios
+    // ──────────────────────────────────────────────────
+    {
+        service: "Cargo Collective",
+        cnamePatterns: ["\\.cargocollective\\.com$"],
+        fingerprints: {
+            body: ["404 Not Found"],
+            status: 404,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#cargo",
+    },
+    {
+        service: "StatusPage (Atlassian)",
+        cnamePatterns: ["\\.statuspage\\.io$"],
+        fingerprints: {
+            body: ["Status page launch  is imminent", "You are being redirected"],
+            status: 302,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#statuspage",
+    },
+    {
+        service: "Surge.sh",
+        cnamePatterns: ["\\.surge\\.sh$"],
+        fingerprints: {
+            body: ["project not found"],
+            status: 404,
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#surge",
+    },
+    {
+        service: "Fly.io",
+        cnamePatterns: ["\\.fly\\.dev$"],
+        fingerprints: {
+            body: ["Could not find the app", "404 Not Found"],
+            status: 404,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#fly",
+    },
+    {
+        service: "Netlify",
+        cnamePatterns: ["\\.netlify\\.app$", "\\.netlify\\.com$"],
+        fingerprints: {
+            body: ["Not Found - Request ID"],
+            status: 404,
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#netlify",
+    },
+    {
+        service: "Vercel",
+        cnamePatterns: ["cname\\.vercel-dns\\.com$", "\\.vercel\\.app$"],
+        fingerprints: {
+            body: ["The deployment could not be found", "DEPLOYMENT_NOT_FOUND"],
+            status: 404,
+            headers: { server: "^Vercel$" },
+        },
+        severity: "high",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#vercel",
+    },
+    {
+        service: "ReadMe",
+        cnamePatterns: ["\\.readme\\.io$"],
+        fingerprints: {
+            body: ["Project doesnt exist"],
+            status: 404,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#readme",
+    },
+    {
+        service: "GitBook",
+        cnamePatterns: ["\\.gitbook\\.io$"],
+        fingerprints: {
+            body: ["If you need specifics"],
+            status: 404,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#gitbook",
+    },
+    {
+        service: "WordPress.com",
+        cnamePatterns: ["\\.wordpress\\.com$"],
+        fingerprints: {
+            body: ["Do you want to register"],
+            status: 404,
+        },
+        severity: "low",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#wordpress",
+    },
+    {
+        service: "Unbounce",
+        cnamePatterns: ["\\.unbouncepages\\.com$"],
+        fingerprints: {
+            body: ["The requested URL was not found on this server"],
+            status: 404,
+        },
+        severity: "medium",
+        documentation: "https://github.com/EdOverflow/can-i-take-over-xyz#unbounce",
+    },
+];
+//# sourceMappingURL=takeover-patterns.js.map

package/dist/data/takeover-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"takeover-patterns.js","sourceRoot":"","sources":["../../src/data/takeover-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAuBH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,qDAAqD;IACrD,iBAAiB;IACjB,qDAAqD;IACrD;QACE,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;QAC7D,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,aAAa,EAAE,8BAA8B,CAAC;YACrD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE;SACvC;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,0DAA0D;KAC1E;IACD;QACE,OAAO,EAAE,cAAc;QACvB,aAAa,EAAE,CAAC,iBAAiB,CAAC;QAClC,YAAY,EAAE;YACZ,IAAI,EAAE;gBACJ,sCAAsC;gBACtC,sFAAsF;aACvF;YACD,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EACX,gEAAgE;KACnE;IACD;QACE,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE;YACb,0BAA0B;YAC1B,wCAAwC;YACxC,+BAA+B;SAChC;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,cAAc,EAAE,qCAAqC,CAAC;YAC7D,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,0DAA0D;KAC1E;IACD;QACE,OAAO,EAAE,iBAAiB;QAC1B,aAAa,EAAE;YACb,yBAAyB;YACzB,4BAA4B;YAC5B,qBAAqB;YACrB,mBAAmB;YACnB,0BAA0B;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;YAC5D,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EACX,yDAAyD;KAC5D;IACD;QACE,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,CAAC,0BAA0B,CAAC;QAC3C,YAAY,EAAE;YACZ,IAAI,EAAE;gBACJ,2CAA2C;gBAC3C,qBAAqB;aACtB;YACD,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EACX,2DAA2D;KAC9D;IACD;QACE,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QACzD,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,8BAA8B,CAAC;YACtC,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,0DAA0D;KAC1E;IACD;QACE,OAAO,EAAE,OAAO;QAChB,aAAa,EAAE,CAAC,gBAAgB,CAAC;QACjC,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,kDAAkD,CAAC;YAC1D,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,yDAAyD;KACzE;IACD;QACE,OAAO,EAAE,UAAU;QACnB,aAAa,EAAE,CAAC,uBAAuB,EAAE,mBAAmB,CAAC;QAC7D,YAAY,EAAE;YACZ,IAAI,EAAE;gBACJ,wBAAwB;gBACxB,gDAAgD;aACjD;YACD,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EACX,4DAA4D;KAC/D;IACD;QACE,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;QAC9D,YAAY,EAAE;YACZ,IAAI,EAAE;gBACJ,sBAAsB;gBACtB,uDAAuD;aACxD;YACD,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,0DAA0D;KAC1E;IACD;QACE,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,CAAC,mBAAmB,CAAC;QACpC,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,oBAAoB,EAAE,mCAAmC,CAAC;YACjE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;SACzC;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EACX,2DAA2D;KAC9D;IAED,qDAAqD;IACrD,8BAA8B;IAC9B,qDAAqD;IACrD;QACE,OAAO,EAAE,kBAAkB;QAC3B,aAAa,EAAE,CAAC,2BAA2B,CAAC;QAC5C,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EACX,yDAAyD;KAC5D;IACD;QACE,OAAO,EAAE,wBAAwB;QACjC,aAAa,EAAE,CAAC,qBAAqB,CAAC;QACtC,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,iCAAiC,EAAE,0BAA0B,CAAC;YACrE,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EACX,8DAA8D;KACjE;IACD;QACE,OAAO,EAAE,UAAU;QACnB,aAAa,EAAE,CAAC,gBAAgB,CAAC;QACjC,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EACX,yDAAyD;KAC5D;IACD;QACE,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,CAAC,eAAe,CAAC;QAChC,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,wBAAwB,EAAE,eAAe,CAAC;YACjD,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,uDAAuD;KACvE;IACD;QACE,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;QACzD,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EACX,2DAA2D;KAC9D;IACD;QACE,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;QAChE,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,mCAAmC,EAAE,sBAAsB,CAAC;YACnE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;SAChC;QACD,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,0DAA0D;KAC1E;IACD;QACE,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,CAAC,iBAAiB,CAAC;QAClC,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,sBAAsB,CAAC;YAC9B,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,0DAA0D;KAC1E;IACD;QACE,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,CAAC,kBAAkB,CAAC;QACnC,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,uBAAuB,CAAC;YAC/B,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EACX,2DAA2D;KAC9D;IACD;QACE,OAAO,EAAE,eAAe;QACxB,aAAa,EAAE,CAAC,qBAAqB,CAAC;QACtC,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,yBAAyB,CAAC;YACjC,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,KAAK;QACf,aAAa,EACX,6DAA6D;KAChE;IACD;QACE,OAAO,EAAE,UAAU;QACnB,aAAa,EAAE,CAAC,yBAAyB,CAAC;QAC1C,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,gDAAgD,CAAC;YACxD,MAAM,EAAE,GAAG;SACZ;QACD,QAAQ,EAAE,QAAQ;QAClB,aAAa,EACX,4DAA4D;KAC/D;CACF,CAAC"}