Added Emqx template (#3978)

* Create emqx-default-login.yaml

* Create emqx-detection.yaml

* more strict matchers

Co-authored-by: sandeep <sandeep@projectdiscovery.io>
patch-1
林寒 2022-03-28 00:18:17 +08:00 committed by GitHub
parent d01169af21
commit fbbcab7333
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 51 additions and 0 deletions

View File

@ -0,0 +1,32 @@
id: emqx-default-login
info:
name: Emqx Default Login
author: For3stCo1d
severity: high
metadata:
shodan-query: http.favicon.hash:"-670975485"
tags: emqx,default-login
requests:
- raw:
- |
POST /api/v4/auth HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
{"username":"{{user}}","password":"{{pass}}"}
attack: pitchfork
payloads:
user:
- admin
pass:
- public
matchers:
- type: dsl
dsl:
- body == "{\"code\":0}"
- status_code == 200
condition: and

View File

@ -0,0 +1,19 @@
id: emqx-detection
info:
name: Emqx Detection
author: For3stCo1d
severity: info
tags: tech,emqx
requests:
- method: GET
path:
- "{{BaseURL}}/static/emq.ico"
matchers-condition: and
matchers:
- type: dsl
name: favicon
dsl:
- "status_code==200 && ('-670975485' == mmh3(base64_py(body)))"