From ae13129575f7178e170f300e432a1b9948bfaee6 Mon Sep 17 00:00:00 2001
From: Prince Chaddha <prince@projectdiscovery.io>
Date: Mon, 1 Aug 2022 10:00:40 +0530
Subject: [PATCH 1/2] Create hybris-default-login.yaml

---
 .../hybris/hybris-default-login.yaml          | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 default-logins/hybris/hybris-default-login.yaml

diff --git a/default-logins/hybris/hybris-default-login.yaml b/default-logins/hybris/hybris-default-login.yaml
new file mode 100644
index 0000000000..1061328260
--- /dev/null
+++ b/default-logins/hybris/hybris-default-login.yaml
@@ -0,0 +1,59 @@
+id: hybris-default-login
+info:
+  name: Hybris Default Login
+  author: princechaddha
+  severity: high
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
+    cvss-score: 8.3
+    cwe-id: CWE-522
+  tags: default-login,hybris
+
+
+requests:
+  - raw:
+      - |
+        GET /login HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{BaseURL}}login
+
+        j_username={{username}}&j_password={{password}}&_csrf={{csrftoken}}
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    attack: pitchfork
+    payloads:
+      username:
+        - admin
+      password:
+        - nimda
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "hybris administration console"
+          - "You're Administrator"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: csrftoken
+        internal: true
+        part: body
+        group: 1
+        regex:
+          - '<meta name="_csrf" content="([a-z0-9-]+)" \/>'

From 023c69f2257d1d2321d304372f561e009a179ea2 Mon Sep 17 00:00:00 2001
From: Prince Chaddha <prince@projectdiscovery.io>
Date: Mon, 1 Aug 2022 10:02:02 +0530
Subject: [PATCH 2/2] Update hybris-default-login.yaml

---
 default-logins/hybris/hybris-default-login.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/default-logins/hybris/hybris-default-login.yaml b/default-logins/hybris/hybris-default-login.yaml
index 1061328260..28a9d32bb1 100644
--- a/default-logins/hybris/hybris-default-login.yaml
+++ b/default-logins/hybris/hybris-default-login.yaml
@@ -7,9 +7,11 @@ info:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
     cvss-score: 8.3
     cwe-id: CWE-522
+  metadata:
+    verified: true
+    shodan-query: title:"Hybris"
   tags: default-login,hybris
 
-
 requests:
   - raw:
       - |