dragonfly-default-login: Dragonfly - Default Login

id: dragonfly-default-login

info:
  name: Dragonfly - Default Login
  author: DhiyaneshDK
  severity: high
  description: |
    Dragonfly was using the default username, and the password was discovered.
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="logo-dragonfly.png"
  tags: dragonfly,default-login,vuln

variables:
  username: "root"
  password: "dragonfly"

http:
  - raw:
      - |
        POST /api/v1/users/signin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json;charset=UTF-8

        {"name":"{{username}}","password":"{{password}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"token":'
          - '{"expire":'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a66ff9b8904f998d97f181610a2954a5091630b2ce9ee3fee0f6fe296c33d07e022100d9e24d21f7e467523521339254c9a4e8da9671e550c4692fa53233fffa5a8d66:922c64590222798bb761d5b6d8e72950