id: azure-vm-cloud-enum

info:
  name: Azure Virtual Machines - Cloud Enumeration
  author: initstring
  severity: info
  description: |
    Searches for Azure virtual machines via their registered DNS names.
  metadata:
    verified: true
    max-request: 1
  tags: cloud,cloud-enum,azure,fuzz,enum,dns

self-contained: true

variables:
  BaseDNS: "cloudapp.azure.com"
  regionname:
    - eastasia
    - southeastasia
    - centralus
    - eastus
    - eastus2
    - westus
    - northcentralus
    - southcentralus
    - northeurope
    - westeurope
    - japanwest
    - japaneast
    - brazilsouth
    - australiaeast
    - australiasoutheast
    - southindia
    - centralindia
    - westindia
    - canadacentral
    - canadaeast
    - uksouth
    - ukwest
    - westcentralus
    - westus2
    - koreacentral
    - koreasouth
    - francecentral
    - francesouth
    - australiacentral
    - australiacentral2
    - southafricanorth
    - southafricawest

dns:
  - name: "{{wordlist}}.{{regionname}}.{{BaseDNS}}"
    type: A
    class: inet

    recursion: true

    attack: batteringram

    matchers:
      - type: word
        part: answer
        words:
          - "IN\tA"
# digest: 4a0a0047304502204d0fc3b9fa192c08f976d00ea8d644b1536049eae245faafd029f246da8e6b1d022100e3a584da363f2d1960192fd6660b09e70c6c9718644931fead2972ed32d5b6ee:922c64590222798bb761d5b6d8e72950