SteVe Login Panel - Detect

ID: steve-default-login

Severity: info

Author: clem9669

Tags: panel,default-login,steve

Description

SteVe login panel was detected.

YAML Source

id: steve-default-login

info:
  name: SteVe Login Panel - Detect
  author: clem9669
  severity: info
  description: |
    SteVe login panel was detected.
  reference:
    - https://github.com/steve-community/steve
    - https://github.com/steve-community/steve/blob/e42ddcf1acf6c4ad2287bb466b2d3550663ce978/src/main/resources/config/test/main.properties
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0
    cwe-id: CWE-200
    cpe: cpe:2.3:a:steve-community:steve:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.title:"SteVe - Steckdosenverwaltung"
    google-query: intitle:"SteVe - Steckdosenverwaltung"
    product: steve
    vendor: steve-community
  tags: panel,default-login,steve

http:
  - raw:
      - |
        GET /steve/manager/signin HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /steve/manager/signin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&_csrf={{csrf}}

    attack: clusterbomb
    payloads:
      username:
        - admin
      password:
        - 1234
    redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "<a>DATA MANAGEMENT"
          - "SIGN OUT</a>"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        name: csrf
        group: 1
        regex:
          - '_csrf" value="(.*?)"/>'
        internal: true
# digest: 4b0a00483046022100a107a3b3ea0183add08f1cf2782c732720332ed907cd63576786fe916e935a3602210096c0600a96f8fc121d3a2e3262fa380d7ed88248f1764ee6a1badee0612228d6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/default-logins/steve/steve-default-login.yaml"

View on Github