fix(aws-bucket-takeover): exclude S3 account regional namespace bucke…

http/takeovers/aws-bucket-takeover.yaml

@@ -1,8 +1,7 @@
 id: aws-bucket-takeover
-
 info:
   name: AWS Bucket Takeover Detection
-  author: pdteam,pwnhxl,zy9ard3
+  author: pdteam,pwnhxl,zy9ard3,venjaku
   severity: high
   description: AWS Bucket takeover was detected.
   reference:
@@ -34,6 +33,12 @@ http:
           - contains(tolower(header), "aliyunoss")
         negative: true
 
+      - type: regex
+        part: host
+        regex:
+          - '^[a-z0-9][a-z0-9-]+-[0-9]{12}-[a-z0-9-]+-an\.s3\.[a-z0-9-]+\.amazonaws\.com'
+        negative: true
+
       - type: word
         part: host
         words:
@@ -71,12 +76,10 @@ http:
           - "oss-me-east-1.aliyuncs.com"
         negative: true
 
-
     extractors:
       - type: regex
         part: body
         group: 1
         regex:
           - '<li>BucketName: (.*?)</li>'
           - '<BucketName>(.*?)</BucketName>'
-# digest: 490a004630440220316ab09e7977d660e576c657d45ec5141ffc7421df5352b23e926340c87f4860022007ac07ec4797b9668d58845b0383448da5031ce561f325a09fd5702097ef487d:922c64590222798bb761d5b6d8e72950