id: netflow-default-login

info:
  name: Netflow Analyzer - Default Login
  author: DhiyaneshDK
  severity: high
  description: |
    Netflow Analyzer default login was discovered.
  classification:
    cpe: cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: zohocorp
    product: manageengine_netflow_analyzer
    shodan-query: html:"Login - Netflow Analyzer"
  tags: default-login,netflow,misconfig

http:
  - raw:
      - |
        POST /netflow/jspui/j_security_check HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        radiusUserEnabled=false&AUTHRULE_NAME=Authenticator&j_username={{username}}&j_password={{password}}&Submit=Login

    attack: pitchfork
    payloads:
      username:
        - admin
      password:
        - admin

    matchers-condition: and
    matchers:
      - type: word
        part: set_cookie
        words:
          - "NFA_Jsession="
          - "JSESSIONID"
        condition: or

      - type: word
        part: location
        words:
          - "/netflow;jsessionid"
# digest: 490a0046304402204a50423eae14769deecb13ed9210933caad956c71ece54b8e30186c49216c83402205217c0af1086834d28f42a54d729f69160d0faa93bd09499c1dd18472449807c:922c64590222798bb761d5b6d8e72950