AI PRP: Minio Weak credentials tester

[JamesFoxxx]

there are multiple default Minio usernames and passwords in the documentation which they asked us to change, if admins forget to change the default credentials it'll be dangerous.

Minio Documentation: https://min.io/docs/minio/linux/operations/installation.html

[maoning]

@JamesFoxxx do you know if the auth can be verified against the MinIO API endpoint which is usually running at port 9000?

We noticed in the past that the MinIO dashboard is running at a random 5-digit port which is hard to always detect.

[JamesFoxxx]

I can work on this, from first glance it has a constant port with the docker setup at least :)
https://min.io/docs/minio/container/index.html

[JamesFoxxx]

@maoning but I'm curious now about what you are asking because it is supposed to be that admins use the default setup instructions which contain the default user/password. By default setup instructions the ports are constant too.(minio server ~/minio --console-address :9001)

[github-actions]

Welcome to the Tsunami patch reward program!

Your issue has been added to our triage queue and will reviewed
shortly. The panel usually takes a decision once per week, so it
can take up to a week before you hear back from us.

Please, do not start the work until the panel has reached a
decision. Although we always welcome contributions, unapproved
work is not eligible for a reward.

~The Tsunami PRP team

[github-actions]

This message is addressed to the Tsunami panel.

Contributor stats

• The contributor has 0 issues tagged as main;
• The contributor has 0 issues tagged as queue.

Useful links

• All open issues from this contributor
• All open PRs from this contributor

[tooryx]

Automated message: Do not reply to that comment or tag the author. We just announced a temporary program freeze please see #752 for details. Thank you for your understanding and patience.

[github-actions]

Congratulations, your request has been approved! 🎉

This means that you can start working on this contribution.

❗ Please take a moment to fill the participation form

If you are unsure where to start, we have compiled a set of
useful guides in our documentation:

📖 https://google.github.io/tsunami-security-scanner/howto/

Unfortunately, our documentation is not yet complete for
fingerprints, Python plugins and weak credential detectors. For
these, we recommend looking at existing plugins.

📢 Read latest announcements on GitHub pages

~The Tsunami PRP team