xxljob-default-login: XXL-JOB Default Login

id: xxljob-default-login

info:
  name: XXL-JOB Default Login
  author: pdteam,ritikchaddha
  severity: high
  description: |
    XXL-JOB default admin credentials were discovered.
    SHODAN: http.favicon.hash:1691956220
    FOFA: icon_hash="1691956220"
  reference:
    - https://github.com/xuxueli/xxl-job
  tags: default-login,xxljob
  created: 2023/07/06

set:
  username: admin
  password: "123456"
rules:
  r0:
    request:
      method: POST
      path: /xxl-job-admin/login
      body: userName={{username}}&password={{password}}
    expression: |
      response.status == 200 &&
      response.body.bcontains(b'"code":200') &&
      response.body.bcontains(b'"msg"') &&
      response.body.bcontains(b'"content"') &&
      response.headers['content-type'].contains('application/json') &&
      response.raw_header.bcontains(b'XXL_JOB_LOGIN_IDENTITY')
  r1:
    request:
      method: POST
      path: /login
      body: userName={{username}}&password={{password}}
    expression: |
      response.status == 200 &&
      response.body.bcontains(b'"code":200') &&
      response.body.bcontains(b'"msg"') &&
      response.body.bcontains(b'"content"') &&
      response.headers['content-type'].contains('application/json') &&
      response.raw_header.bcontains(b'XXL_JOB_LOGIN_IDENTITY')
expression: r0() || r1()