Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Hello @joernNNN. Can you please link the testbed?

@leonardo-doyensec i updated the first comment to contain the testbeds.

Hello @joernNNN. Thank you for your contribution. I'm noticing that the plugin is not working correctly. When i try to run the plugin on my side it's not running at all. Can you please check it on your side?

Feel free to reach out
~ Leonardo (Doyensec)

Friendly ping @joernNNN

@leonardo-doyensec, Thanks for the ping, I totally missed your comment. I'm going to solve this issue today.

@leonardo-doyensec the plugin is working fine.

You must also use the google/fingerprinters/web plugin when you want to run the Tsunami CLI, I think.

because we are checking whether the service is airflow, we need to do the fingerprinting step before running the weak credential tester plugin.

  @Override
  public boolean canAccept(NetworkService networkService) {
    return NetworkServiceUtils.getWebServiceName(networkService).equals(AIRFLOW_SERVICE);
  }

the command line switches I use and the version of the Tsunami CLI can be seen in the following:

java -cp "tsunami-main-0.0.24-SNAPSHOT-cli.jar:/home/joern/tsunami/myPlugins/*"   -Dtsunami-config.location=/home/joern/tsunami/tsunami_tcs.yaml   com.google.tsunami.main.cli.TsunamiCli   --uri-target=http://localhost:8080/    --http-client-trust-all-certificates --scan-results-local-output-format=JSON   --scan-results-local-output-filename=/tmp/tsunami-output.json

Hello @leonardo-doyensec
I noticed the number of credentials for brute-forcing too. I tried to find an immediate solution like finding a method in TestCredential or CredentialTester classes but there is not anything helpful.

@tooryx I would like to know if we can have only the default credentials for a weak credential plugin to brute-force not all other default credentials or top username and password lists.