One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password

Default Credentials Cheat Sheet

One place for all the default credentials to assist the pentesters during an engagement, this document has a several products default credentials that are gathered from several sources.

P.S : Most of the credentials are extracted from the changeme,routersploit and Seclists projects, you can use these tools to automate the process https://github.com/ztgrace/changeme , https://github.com/threat9/routersploit (kudos for the awesome work)

• Project in progress

Motivation

• One document for the most known vendors default credentials
• Assist pentesters during a pentest/red teaming engagement
• Helping the Red/Blue teamers to secure the company infrastructure by discovering this security flaw in order to mitigate it. See OWASP Guide [WSTG-ATHN-02] - Testing_for_Default_Credentials

Short stats of the dataset

Sources

• Changeme
• Routersploit
• betterdefaultpasslist
• Seclists
• Vendors documentations/blogs

Creds script

You can turn the cheat sheet into a cli command and perform search queries for a specific product.

# Usage
➤ python3 creds search tomcat                                                                                                      
+----------------------------------+------------+------------+
| Product                          |  username  |  password  |
+----------------------------------+------------+------------+
| apache tomcat (web)              |   tomcat   |   tomcat   |
| apache tomcat (web)              |   admin    |   admin    |
...
+----------------------------------+------------+------------+

Contribute

If you cannot find the password for a specific product, please submit a pull request to update the dataset.

Disclaimer

For educational purposes only, use it at your own responsibility.