id: ftp-weak-credentials

info:
  name: FTP Service - Credential Weakness
  author: pussycat0x
  severity: high
  description: An FTP service was accessed with easily guessed credentials.
  reference:
    - https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/ftpserver/security/authentication/
  classification:
    cvss-score: 8.5
    cvss-metrics: 3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
  tags: network,ftp,default-login,service
  metadata:
    max-request: 2

tcp:

  - inputs:
      - data: "USER {{username}}\r\nPASS {{password}}\r\n"

    host:
      - "{{Hostname}}"
      - "{{Host}}:21"

    attack: clusterbomb
    payloads:
      username:
        - admin
        - root
      password:
        - password
        - toor
        - nas
        - guest
        - default
        - pass1
        - stingray

    matchers:
      - type: word
        words:
          - "230 Login successful"

# Enhanced by mp on 2022/05/23