Create elasticsearch-default-login.yaml

[DhiyaneshGeek]

Template / PR Information

• Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
• References:

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[omranisecurity]

Fixed, please check again.

[DhiyaneshGeek]

Hi @omranisecurity i have validated locally

using this docker https://github.com/deviantony/docker-elk/blob/main/README.md

here is the debug data

[elasticsearch-default-login] ElasticSearch - Default Login (@mohammad reza omrani | @omranisecurity) [high]
[INF] [elasticsearch-default-login] Dumped HTTP request for http://localhost:5601/internal/security/login

POST /internal/security/login HTTP/1.1
Host: localhost:5601
User-Agent: Mozilla/5.0 (Windows; Windows NT 10.1; Win64; x64; en-US) Gecko/20100101 Firefox/49.5
Connection: close
Content-Length: 145
Content-Type: application/json
Origin: http://localhost:5601
Referer: http://localhost:5601/login
kbn-version: 8.8.2
x-kbn-context: %7B%22name%22%3A%22security_login%22%2C%22url%22%3A%22%2Flogin%22%7D
Accept-Encoding: gzip

{"providerType":"basic","providerName":"basic","currentURL":"http://localhost:5601/login","params":{"username":"elastic","password":"changeme" }}
[DBG] [elasticsearch-default-login] Dumped HTTP response http://localhost:5601/internal/security/login

HTTP/1.1 200 OK
Connection: close
Content-Length: 16
Cache-Control: private, no-cache, no-store, must-revalidate
Content-Security-Policy: script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'
Content-Type: application/json; charset=utf-8
Cross-Origin-Opener-Policy: same-origin
Date: Mon, 24 Jul 2023 11:02:06 GMT
Kbn-License-Sig: 9cb48bdd34a4864d65c8c80f312a91cd185618f97e253aa0159681e52c981bd2
Kbn-Name: kibana
Referrer-Policy: no-referrer-when-downgrade
Set-Cookie: sid=Fe26.2**0f884888d970fd915e531f42d83531c581b874165ce4a3dc9b61b5d6f2cd7f4d*alTZZLFQXWbyQorPQfnVBQ*QyR8UhvjpAgu4oHQl6p-cvWdOdD3Kkns2Z2yINrlgj3upNBP4-AZPtzU28N8_yP2mRanBhOkFon-ebCno_l_GTaO_xDzknJbe97wfSkPAjhhAC5d3kHcerVp_Lu2fGIxYr-0sY1rqKL3dKWBqo75EW4tGh0pC9iEoO7Cm_eE6sf7Opv6goXncbZctSVkz70nwVcpCYY2Q8aC1Z6SvImT34rDS4zNKBNL4d3JAc8AdjMjpLUPzCF-odVeeGw3j6TH**ab5b61234e7539da5b4cc9504efc76529213f5239eb8c793ae646f66fc5ecebc*nPWx5unaW-UCzvUgjpEravFeqVsQJZsc9KVBz6f3zeE; HttpOnly; Path=/
X-Content-Type-Options: nosniff

{"location":"/"}
[elasticsearch-default-login:word-1] [http] [high] http://localhost:5601/internal/security/login [password="changeme",username="elastic"]
[elasticsearch-default-login:status-2] [http] [high] http://localhost:5601/internal/security/login [password="changeme",username="elastic"]