Cloud-20Engineering/Powershell/RunBooks/SubdomainTakeOver.ps1

Import-Module Az.Accounts
Import-Module Az.Websites
Import-Module Az.FrontDoor
Import-Module Az.Storage
Import-Module Az.Cdn
Import-Module Az.Network
Import-Module Az.TrafficManager
Import-Module Az.ContainerInstance

class DomainNameCheck {
    [string] $SubscriptionId = ""
    [string] $SubscriptionName = ""
    [string] $ResourceId = ""
    [string] $ResourceGroupName = ""
    [string] $ResourceName = ""
    [string] $ResourceType = ""
    [string] $DomainName = ""
    [string] $Tag_Team = ""
    [string] $Tag_Product = ""
    [string] $Tag_Environment = ""
    [string] $Tag_Data = ""
}

$subscriptions = Get-AzSubscription | Where-Object State -eq "Enabled"


foreach ($subscription in $subscriptions) 
{
    context = Set-AzContext -SubscriptionId $subscription.Id

    $webApps = get-azwebapp 
    $webAppsEffectory = $webApps | Where-Object {@($_.HostNames) -like "*.effectory.com"} # app service

    foreach ($webApp in $webApps) {
        $slot = Get-AzWebAppSlot -WebApp $webApp 
        if ($slotHostNames = $slot | Where-Object {@($_.HostNames) -like "*.effectory.com"}) {
           # app service slots
        }
    }

    $frontDoors = Get-AzFrontDoor
    foreach($frontDoor in $frontDoors) {
        if ($endPointHostNames = $frontDoor.FrontendEndpoints | Where-Object HostName -like "*.effectory.com") {
            # frontdoor
        }
    }

    $effectoryStorage = Get-AzStorageAccount | Where-Object { $_.CustomDomain.Name -like "*.effectory.com" } # storage accounts

    $cdnProfiles = Get-AzCdnProfile
    foreach($cdnProfile in $cdnProfiles) {
        $cdnEndPoints = Get-AzCdnEndpoint -ProfileName $cdnProfile.Name -ResourceGroupName $cdnProfile.ResourceGroupName
        foreach($cdnEndPoint in $cdnEndPoints) {
            $cdnEffectory = Get-AzCdnCustomDomain -CdnEndpoint $cdnEndPoint | Where-Object HostName -Like "*.effectory.com" # cdn endpoints
        }
    }

    $ipAddresses = Get-AzPublicIpAddress | Where-Object DnsSettings -ne $null  | Where-Object { $_.DnsSettings.DomainNameLabel -ne "" } # public ip => Assume binding ? 

    $trafficManagers = Get-AzTrafficManagerProfile
    foreach ($trafficManager in $trafficManagers) {
        #$trafficManager.RelativeDnsName
        # traffic manager
    }

    $containerInstances =  Get-AzContainerGroup
    foreach ($containerInstance in  $containerInstances) {
        #$containerInstance.Fqdn
        #container instance
    }
}

## TODO


## Azure API Management	microsoft.apimanagement/service	abc.azure-api.net




#Set-AzContext -SubscriptionId "a134faf1-7a89-4f2c-8389-06d00bd5e2a7"
#Set-AzContext -SubscriptionId "750d0421-da63-42fb-9f89-74aeb5dfe05b"