takeover-guard - Subdomain Takeover Scan Files

Highlights

1. Zero-Credential Static HCL Workspace Scanning (pkg/localscan)

• Scans Terraform .tf workspace configurations directly without requiring terraform init, cloud provider credentials, or a generated plan file.
• Inspects and correlates DNS records and tenancy endpoints across:
• AWS: Route53 (aws_route53_record CNAME & ALIAS) and S3 (aws_s3_bucket)
• Cloudflare: DNS records (cloudflare_record)
• Azure DNS: CNAME and A records (azurerm_dns_cname_record, azurerm_dns_a_record)
• Google Cloud DNS: Resource record sets (google_dns_record_set)
• In GitHub Actions (SubdomainWatch/takeover-guard@v2), plan_file: '' is optional and defaults to zero-credential static scanning via tf_dir: '.'.

2. CLI Flag --plan & --plan-file Alias Support

• Supports both --plan-file and --plan flags for inspecting speculative Terraform plan JSON files.
• Automatically selects the static HCL engine when running locally or when no plan file is supplied.

3. Hardened Prober/Syncer Network Guards & Global-Only Git Lookup

• SSRF Hardening: Hardened pkg/prober and pkg/syncer network guards against cloud metadata access (AWS IMDSv1/v2, Azure, GCP) and private CIDR ranges.
• Git Config Safety: Restricted pre-commit override snippet generation to --global git config lookup, ensuring local repository .git/config files are never evaluated.