diff --git a/default-logins/apache/karaf-default-login.yaml b/default-logins/apache/karaf-default-login.yaml new file mode 100644 index 0000000000..46e2b4b2a3 --- /dev/null +++ b/default-logins/apache/karaf-default-login.yaml @@ -0,0 +1,36 @@ +id: karaf-default-login + +info: + name: Apache Karaf Default Login + author: s0obi + severity: high + description: Apache Karaf default login credentials were discovered. + reference: + - https://karaf.apache.org/manual/latest/webconsole + metadata: + verified: true + shodan-query: realm="karaf" + tags: default-login,apache,karaf + +requests: + - raw: + - | + GET /system/console HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64('karaf:karaf')}} + + host-redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Apache Karaf Web Console - Bundles" + - "Web Console" + - "Log out" + condition: and + + - type: status + status: + - 200 diff --git a/technologies/apache/apache-karaf-panel.yaml b/technologies/apache/apache-karaf-panel.yaml new file mode 100644 index 0000000000..d285acce99 --- /dev/null +++ b/technologies/apache/apache-karaf-panel.yaml @@ -0,0 +1,21 @@ +id: apache-karaf-panel + +info: + name: Apache Karaf Detect + author: s0obi + severity: info + metadata: + verified: true + shodan-query: realm="karaf" + tags: tech,apache,karaf + +requests: + - method: GET + path: + - "{{BaseURL}}/system/console" + + matchers: + - type: word + part: header + words: + - 'realm="karaf'