Create empire-C2.yaml

default-logins/empire-C2.yaml

@@ -0,0 +1,39 @@
+id: empireC2-default-login-api
+
+info:
+  name: Empire-C2 Default Login Api
+  author: clem9669
+  severity: high
+  description: Kanboard default login was discovered.
+  reference:
+    - https://github.com/BC-SECURITY/Empire
+    - https://bc-security.gitbook.io/empire-wiki/quickstart/configuration/server
+  tags: default-login,empire
+  
+requests:
+  - raw:
+      - |
+        POST /api/admin/login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+        
+        {"username":"{{user}}","password":"{{pass}}"}
+
+    attack: pitchfork
+    payloads:
+      user:
+        - empireadmin
+      pass:
+        - password123
+ 
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'token'
+        condition: and
+        case-insensitive: true
+
+      - type: status
+        status:
+          - 200