id: kyan-credential-exposure
info:
name: Kyan network monitoring device account and password exposure
author: pikpikcu
severity: medium
reference:
- https://mp.weixin.qq.com/s/6phWjDrGG0pCpGuCdLusIg
tags: kyan,exposure,config,network
requests:
- method: GET
path:
- "{{BaseURL}}/hosts"
matchers-condition: and
matchers:
- type: word
words:
- "UserName="
- "Password="
condition: and
- "text/plain"
part: header
- type: status
status:
- 200