Added vidyo-super default-creds Template

2021-09-02 16:15:34 +00:00 · 2021-09-02 16:15:34 +00:00 · 38d219be53
parent a54057007e
commit 38d219be53
1 changed files with 86 additions and 0 deletions
--- a/default-logins/vidyo/vidyo-super-admin.yaml
+++ b/default-logins/vidyo/vidyo-super-admin.yaml
@ -0,0 +1,86 @@
+id: vidyo-Default-Credentials
+
+info:
+  name: Vidyo Default Credentials
+  author: izn0u0
+  severity: medium
+  description: test for default cred super:password
+  tags: vidyo,default-login
+
+
+requests:
+  - raw:
+    - |
+        GET /super/login.html?lang=en HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+    - |
+        POST /super/super_security_check;jsessionid={{session}}?csrf_tkn={{csrf_tkn}} HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 32
+        Origin: {{BaseURL}}
+        DNT: 1
+        Connection: close
+        Referer: http://{{Hostname}}/super/login.html?lang=en
+        Cookie: JSESSIONID={{session}} ; VidyoPortalSuperLanguage=en
+        Upgrade-Insecure-Requests: 1
+
+        username=super&password=password
+
+
+    - |
+        GET /super/loginhistory.html?csrf_tkn={{csrf_tkn}} HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: {{BaseURL}}/super/login.html?lang=en
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+
+
+
+
+    extractors:
+      - type: regex
+        name: csrf_tkn
+        group: 1
+        part: body
+        internal: true
+        regex:
+          - 'csrf_tkn=([A-Za-z0-9.-]+)'
+
+      - type: kval
+        name: session
+        internal: true
+        part: header
+        kval:
+          - JSESSIONID
+
+    cookie-reuse: true
+    redirects: true
+    #matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      #- type: word
+        #words: 
+          #- "welcome to"
+        #part: body
+      #- type: dsl
+        #dsl:
+          #- 'contains(body, "welcome to")'