Description
Default credentials (CWE-1392) represent one of the simplest and most consistently successful attack vectors in penetration testing. Vendors ship routers, firewalls, IP cameras, database servers, CMS platforms, cloud management consoles, and industrial control systems with pre-configured administrative credentials — typically admin:admin, admin:password, root:root, or published in publicly available product manuals.
When administrators deploy these systems without changing the default credentials, any attacker who knows (or looks up) the vendor defaults gains immediate, full administrative access. This requires no vulnerability research, no exploit development, and no sophisticated tooling — just a credential lookup and a login form. The attack is catalogued under OWASP A07:2021 (Identification and Authentication Failures) and has been responsible for some of the largest infrastructure breaches and botnet infections in history, including Mirai, which compromised hundreds of thousands of IoT devices using default credentials.
Default credentials are pervasive across network infrastructure (routers, switches, VPNs, firewalls), database management interfaces (phpMyAdmin, Adminer, MongoDB Express), CI/CD and DevOps tooling (Jenkins, Grafana, Kibana, Portainer), embedded devices (IP cameras, printers, PLCs), and SaaS administration portals.
How It Works
An attacker performing network reconnaissance discovers an exposed Jenkins instance at https://jenkins.target.com. They attempt the known Jenkins default: admin:admin. Access is granted.
Alternatively, an OSINT scan using Shodan identifies a MongoDB instance exposed on port 27017 with no authentication — another form of "default" where authentication was never configured.
For systematic attacks, tools like Hydra, Medusa, and Burp Suite Intruder automate default credential testing against HTTP login forms, SSH, FTP, Telnet, SNMP, and database protocols:
# Hydra against an HTTP form with a default credentials wordlist
hydra -C /usr/share/seclists/Passwords/Default-Credentials/default-passwords.csv \
target.com http-post-form "/login:username=^USER^&password=^PASS^:Login failed"
Database-specific defaults commonly found in penetration tests:
| Service | Default Credentials | |---------|-------------------| | MySQL | root: (no password) | | PostgreSQL | postgres:postgres | | Microsoft SQL Server | sa: (no password) | | MongoDB | (no auth by default pre-3.0) | | Redis | (no auth by default) | | Jenkins | admin:admin | | Grafana | admin:admin | | Portainer | admin:tryportainer |
Cloud misconfigurations also fall into this category: S3 buckets with public ACLs, Kubernetes dashboards with no authentication (kubectl proxy exposed), and AWS console accounts with admin:Admin1! set during initial provisioning and never changed.
The DefaultCreds-Cheat-Sheet (GitHub repository) and SecLists contain comprehensive databases of vendor-specific defaults used in professional penetration testing engagements.
Impact
- Full Administrative Access — Immediate root or administrator access to the compromised system without exploitation
- Data Exfiltration — Direct access to databases, file shares, and configuration data containing customer PII and credentials
- Lateral Movement — Using the compromised management interface to pivot to other internal systems using the same or related credentials
- Persistent Backdoor — Creating new administrative accounts before changing credentials, maintaining access after the default password is eventually changed
- Infrastructure Takeover — Compromising hypervisors, network devices, and CI/CD pipelines to gain control of the entire infrastructure stack
- Botnet Enrollment — IoT and embedded device compromise for DDoS, cryptomining, or traffic proxying
Detection
- Enumerate all services and management interfaces — use Nmap (
nmap -sV -p 80,443,8080,8443,22,23,3306,5432,6379,27017,9200) and Shodan to identify exposed services and their version banners. - Test all discovered services against known defaults — reference the DefaultCreds-Cheat-Sheet and SecLists
Passwords/Default-Credentials/directory. Test manually or with Hydra. - Check cloud infrastructure for unauthenticated endpoints — test Kubernetes dashboards, Elasticsearch without X-Pack security, and Jenkins with anonymous read enabled.
- Test network infrastructure credentials — SNMP community strings (
public,private), router admin panels (admin:admin,admin:password), and out-of-band management (iDRAC, iLO, IPMI) with default vendor credentials. - Scan for database services without authentication — attempt
mongo --host target,redis-cli -h target PING, and MySQL with no password. An unanswered auth prompt is a finding. - Review provisioning and infrastructure-as-code — check Terraform, Ansible, and CloudFormation templates for hardcoded default credentials in resource definitions.
Remediation
Change all default credentials immediately upon deployment. Make credential rotation a mandatory step in the deployment checklist for every system, device, and service.
Enforce unique, strong credentials. Use a password manager or secrets management system (HashiCorp Vault, AWS Secrets Manager) to generate and store random administrative credentials.
Disable default accounts where possible. Many systems allow deleting or disabling the default admin account entirely. Create a named administrative account instead.
Implement network segmentation. Place management interfaces (IPMI, vCenter, Jenkins, database admin tools) on a separate VLAN accessible only from a jump host or VPN. Remove all management interfaces from internet exposure.
Use infrastructure scanning tools. Integrate tools like Nuclei (with the default-credentials templates) into your CI/CD pipeline to automatically detect default credentials across deployed infrastructure.