Merge pull request #8332 from projectdiscovery/princechaddha-patch-2

Create xploitspy-default-login.yaml

http/default-logins/xploitspy/xploitspy-default-login.yaml

@@ -0,0 +1,49 @@
+id: xploitspy-default-login
+
+info:
+  name: XploitSPY - Default Login
+  author: andreluna
+  severity: high
+  description: |
+    Default login and password to access administrator panel
+  reference:
+    - https://github.com/XploitWizer-Community/XploitSPY
+  metadata:
+    shodan-query: html:XploitSPY
+    max-request: 3
+  tags: xploitspy,default-login
+
+http:
+  - raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{RootURL}}/login
+
+        username={{user}}&password={{pass}}&hostname={{Hostname}}
+
+    cookie-reuse: true
+    attack: pitchfork
+    payloads:
+      user:
+        - admin
+      pass:
+        - password
+
+    redirects: true
+    max-redirects: 2
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Change Password"
+          - "Logout"
+        condition: and
+
+      - type: status
+        status:
+          - 200