Description

This detector identifies API endpoints that accept default or weak credentials during authentication attempts. It tests login endpoints by attempting authentication with common default username/password combinations and reports when these credentials are successfully accepted, indicating a serious authentication bypass vulnerability.

Detection Strategy

• Targets HTTP POST, PUT, or PATCH requests to endpoints identified as login URLs

• Analyzes request bodies to ensure they contain password fields for authentication

• Attempts authentication using common default credential combinations

• Reports vulnerability when default credentials are successfully accepted by the API endpoint