loading
Loading content
loading
Vulnerability Scanning
Probe URL lists for admin panels across stacks, then try vendor default credentials on a subset. Headers and rate-limit included for fleet-scale runs.
Exposed admin panels are management login UIs left reachable on the web, and a vendor default credential on one is a fast path to takeover. This module probes a URL list for admin panel detection across stacks, then tries default credentials on a subset of the panels it finds. A login page found is detection, not a login that worked.
You feed a list of live URLs. This module probes known administrative login UIs across stacks, then tries vendor default credentials on a subset of those panels. A login page found is not a login that worked. Recursive checks walk input URL path prefixes, not a directory wordlist.
Probe for Web Servers
writes the URL list. Optionally nest
Discover Paths via Crawling
or
Discover Paths via Directory Brute Force
first so the prefixes you hand this module are deeper than /.
findings into
Generate Scan Report.
Nest the four exposure modules on the same URL list after probe: this page, backups, secrets, and sensitive files. Same face, four artifact classes. Do not share one H1. Web default credentials are this module; SSH, FTP, and database passwords are Scan Network Services for Weak Credentials on the network tail.
Nest this after you have live web URLs and you want management login UIs, then default-cred checks on a subset of those UIs. A root-only list only sees panels at those prefixes. Crawl or directory brute force first if you need deeper path prefixes under the same hosts.
urls (FILE): live web URLs, one per line. Example: https://foo.example.com.
header (STRING): header(s) to include in HTTP requests.
header-file (FILE): the same headers, from a file.
rate-limit (STRING, default 300 per second per machine): a ceiling, not
findings (FILE): JSONLines. Each row carries finding, location, severity,
The tables this module produces. Sample rows are illustrative.
Detected admin/login panels and default-credential hits on a subset of them.
findingtext | locationurl | severitytext | hostnametext | domain_nametext | ip_addresstext | methodtext | descriptiontext | requesttext | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Pulse Secure VPN Login Panel | https://vpn.example.com/dana-na/auth/url_default.cgi | info | vpn.example.com | example.com | 203.0.113.10 | GET | Administrative login UI detected at a known admin path. | GET /dana-na/auth/url_default.cgi HTTP/1.1 |
| 2 | Apache Tomcat Manager Panel | https://app.example.com/manager/html | info | app.example.com | example.com | 203.0.113.20 | GET | Tomcat management interface reachable. | GET /manager/html HTTP/1.1 |
| 3 | Default Credentials Confirmed | https://admin.example.com/admin/login.php | high | admin.example.com | example.com | 198.51.100.42 | POST | Vendor default credentials accepted on the login form. | POST /admin/login.php HTTP/1.1 |
Scan for Exposed Admin Panels
Artifact class it owns
Management / login UI; default creds on a subset
Upstream it needs
live urls
Artifact class it owns
Hostname-named .bak/.sql/zip/tarball
Upstream it needs
live urls
Artifact class it owns
Patterns in the response you fetched
Upstream it needs
live urls
Artifact class it owns
.env, .git/config, logs, dev artifacts
Upstream it needs
live urls
questions
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.