diff --git a/http/default-logins/easyreport/easyreport-default-login.yaml b/http/default-logins/easyreport/easyreport-default-login.yaml new file mode 100644 index 0000000000..5e7f587cfb --- /dev/null +++ b/http/default-logins/easyreport/easyreport-default-login.yaml @@ -0,0 +1,50 @@ +id: easyreport-default-login + +info: + name: EasyReport - Default Login + author: SleepingBag945 + severity: high + classification: + cwe-id: CWE-798 + metadata: + max-request: 1 + verified: true + fofa-query: body="EasyReport-A Sample and Easy to Use Web Reporting System" + tags: easyreport,default-login + +http: + - raw: + - | + POST /member/authenticate HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/javascript, */*; q=0.01 + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-Requested-With: XMLHttpRequest + + account={{username}}&password={{password}}&rememberMe=false + + attack: pitchfork + payloads: + username: + - admin + password: + - 123456 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"code":' + - '"detailMsg":' + - '"data":true' + condition: and + + - type: word + part: header + words: + - 'application/json' + + - type: status + status: + - 200