id: lvmeng-uts-disclosure

info:
  name: Lvmeng - UTS Disclosure
  author: pikpikcu
  severity: high
  description: Lvmeng UTS was discovered.
  tags: config,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/webapi/v1/system/accountmanage/account"
    headers:
      Content-Type: application/json

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "application/json"
        condition: and
        part: header
      - type: word
        words:
          - "password"
          - "nsfocus_uts"
          - "MANAGER_IP"
        condition: and
        part: body

# Enhanced by mp on 2022/07/15