xxljob-panel: XXLJOB Admin Login Panel - Detect

2025-08-01 xxljob-panel PoC Public

Description

XXLJOB admin login panel was detected.

shodan: http.favicon.hash:1691956220

fofa: icon_hash="1691956220"

PoC

id: xxljob-panel

info:
  name: XXLJOB Admin Login Panel - Detect
  author: pdteam,daffainfo,ritikchaddha
  severity: info
  verified: true
  description: |-
    XXLJOB admin login panel was detected.
    shodan: http.favicon.hash:1691956220
    fofa: icon_hash="1691956220"
  tags: panel,xxljob,login
  created: 2023/07/06

rules:
  r0:
    request:
      method: GET
      path: /xxl-job-admin/toLogin
    expression: response.status == 200 && response.body.bcontains(b'<a><b>XXL</b>JOB</a>')
    extractors:
      - type: regex
        extractor:
          ext1: '"\"admin_version\":\"(?P<admin_version>.*?)\"".bsubmatch(response.raw)'
          admin_version: ext1["admin_version"]
  r1:
    request:
      method: GET
      path: /toLogin
    expression: response.status == 200 && response.body.bcontains(b'<a><b>XXL</b>JOB</a>')
    extractors:
      - type: regex
        extractor:
          ext1: '"\"admin_version\":\"(?P<admin_version>.*?)\"".bsubmatch(response.raw)'
          admin_version: ext1["admin_version"]
expression: r0() || r1()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/fingerprinting/xxljob-panel.yaml

References

Related Vulnerabilities