Code Monkey home page Code Monkey logo

defaultcreds-cheat-sheet's Introduction

Default Credentials Cheat Sheet

One place for all the default credentials to assist pentesters during an engagement, this document has several products default login/password gathered from multiple sources.

P.S : Most of the credentials were extracted from changeme,routersploit and Seclists projects, you can use these tools to automate the process https://github.com/ztgrace/changeme , https://github.com/threat9/routersploit (kudos for the awesome work)

  • Project in progress

Motivation

  • One document for the most known vendors default credentials
  • Assist pentesters during a pentest/red teaming engagement
  • Helping the Blue teamers to secure the company infrastructure assets by discovering this security flaw in order to mitigate it. See OWASP Guide [WSTG-ATHN-02] - Testing_for_Default_Credentials

Short stats of the dataset

Product/Vendor Username Password
count 3548 3548 3548
unique 1255 1108 1644
top Oracle
freq 235 725 463

Sources

Installation & Usage

The Default Credentials Cheat Sheet tool is available on pypi

$ pip3 install defaultcreds-cheat-sheet
$ creds search tomcat
Operating System Tested
Linux(Kali,Ubuntu,Lubuntu) βœ”οΈ
Windows(10,11) βœ”οΈ
macOS ❌
Manual Installation
$ git clone https://github.com/ihebski/DefaultCreds-cheat-sheet
$ pip3 install -r requirements.txt
$ cp creds /usr/bin/ && chmod +x /usr/bin/creds
$ creds search tomcat

Creds script

Usage Guide

# Search for product creds
➀ creds search tomcat                                                                                                      
+----------------------------------+------------+------------+
| Product                          |  username  |  password  |
+----------------------------------+------------+------------+
| apache tomcat (web)              |   tomcat   |   tomcat   |
| apache tomcat (web)              |   admin    |   admin    |
...
+----------------------------------+------------+------------+

# Update records
➀ creds update
Check for new updates...πŸ”
New updates are available 🚧
[+] Download database...

# Export Creds to files (could be used for brute force attacks)
➀ creds search tomcat export
+----------------------------------+------------+------------+
| Product                          |  username  |  password  |
+----------------------------------+------------+------------+
| apache tomcat (web)              |   tomcat   |   tomcat   |
| apache tomcat (web)              |   admin    |   admin    |
...
+----------------------------------+------------+------------+

[+] Creds saved to /tmp/tomcat-usernames.txt , /tmp/tomcat-passwords.txt πŸ“₯

Run creds through proxy

# Search for product creds
➀ creds search tomcat --proxy=http://localhost:8080

# update records
➀ creds update --proxy=http://localhost:8080

# Search for Tomcat creds and export results to /tmp/tomcat-usernames.txt , /tmp/tomcat-passwords.txt
➀ creds search tomcat --proxy=http://localhost:8080 export

Proxy option is only available from version 0.5.2

asciicast

Pass Station

noraj created CLI & library to search for default credentials among this database using DefaultCreds-Cheat-Sheet.csv. The tool is named Pass Station (Doc) and has some powerful search feature (fields, switches, regexp, highlight) and output (simple table, pretty table, JSON, YAML, CSV).

asciicast

Contribute

If you cannot find the password for a specific product, please submit a pull request to update the dataset.

Disclaimer

For educational purposes only, use it at your own responsibility.

defaultcreds-cheat-sheet's People

Contributors

0xjv avatar cosad3s avatar crypt0rr avatar e-euler avatar encodedguy avatar fabaff avatar hamoshwani avatar htarsoo avatar hvprvtr avatar ihebski avatar ilplais avatar imennodenis avatar jxshu4 avatar kingthorin avatar luh2 avatar mtrp12 avatar noraj avatar parveshdhull avatar snovvcrash avatar xavierroot avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

defaultcreds-cheat-sheet's Issues

Unable to install pip3 install -r requirements.txt

Hi, I'm unable to install requirements.txt.

It's showing some error

Γ— python setup.py egg_info did not run successfully.
β”‚ exit code: 1
╰─> [30 lines of output]
Traceback (most recent call last):
File "", line 2, in
File "", line 34, in
File "/tmp/pip-install-vn9do36r/hashlib_613de39c63484668ad3e7e574a224a1a/setup.py", line 68
print "unknown OS, please update setup.py"
^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print("unknown OS, please update setup.py")?
Error in sys.excepthook:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/apport_python_hook.py", line 72, in apport_excepthook
from apport.fileutils import likely_packaged, get_recent_crashes
File "/usr/lib/python3/dist-packages/apport/init.py", line 5, in
from apport.report import Report
File "/usr/lib/python3/dist-packages/apport/report.py", line 21, in
from urllib.request import urlopen
File "/usr/lib/python3.8/urllib/request.py", line 87, in
import hashlib
File "/tmp/pip-install-vn9do36r/hashlib_613de39c63484668ad3e7e574a224a1a/hashlib.py", line 80
raise ValueError, "unsupported hash type"
^
SyntaxError: invalid syntax

  Original exception was:
  Traceback (most recent call last):
    File "<string>", line 2, in <module>
    File "<pip-setuptools-caller>", line 34, in <module>
    File "/tmp/pip-install-vn9do36r/hashlib_613de39c63484668ad3e7e574a224a1a/setup.py", line 68
      print "unknown OS, please update setup.py"
            ^
  SyntaxError: Missing parentheses in call to 'print'. Did you mean print("unknown OS, please update setup.py")?
  [end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
error: metadata-generation-failed

Γ— Encountered error while generating package metadata.
╰─> See above for output.

note: This is an issue with the package mentioned above, not pip.
hint: See above for details.

[Improvement] Default credentials for GLPI instances

Hi ! :)

GLPI is a quite frequent web service, especially within French companies. It's an IT Asset Management software with frequent vulnerabilities, either pre-auth or post-auth.

It can be common to find default credentials from the GLPI internal database on dev/prod instances on an internal network :

Default login/passwords are:

  • glpi / glpi
  • tech tech
  • normal / normal
  • post-only postonly

Source :

Request

Plz add file default-username.txt and default-password.txt for bruteforce

Error when trying to update on Windows

Hello,
I had installed DefaultCreds. But when I'm trying to update the database, I've got an error message about the temporary folder.
Here is the error:

PS C:\> creds update
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Python312\Scripts\creds.exe\__main__.py", line 7, in <module>
  File "C:\Python312\Lib\site-packages\DefaultCreds\creds.py", line 127, in run
    fire.Fire()
  File "C:\Python312\Lib\site-packages\fire\core.py", line 141, in Fire
    component_trace = _Fire(component, args, parsed_flag_args, context, name)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Python312\Lib\site-packages\fire\core.py", line 475, in _Fire
    component, remaining_args = _CallAndUpdateTrace(
                                ^^^^^^^^^^^^^^^^^^^^
  File "C:\Python312\Lib\site-packages\fire\core.py", line 691, in _CallAndUpdateTrace
    component = fn(*varargs, **kwargs)
                ^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Python312\Lib\site-packages\DefaultCreds\creds.py", line 122, in update
    get_db('/tmp',"Check for new updates...πŸ”")
  File "C:\Python312\Lib\site-packages\DefaultCreds\creds.py", line 35, in get_db
    db = TinyDB(f"{path}/DefaultCreds_db.json",storage=CachingMiddleware(JSONStorage))
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Python312\Lib\site-packages\tinydb\database.py", line 94, in __init__
    self._storage: Storage = storage(*args, **kwargs)
                             ^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Python312\Lib\site-packages\tinydb\middlewares.py", line 63, in __call__
    self.storage = self._storage_cls(*args, **kwargs)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Python312\Lib\site-packages\tinydb\storages.py", line 113, in __init__
    touch(path, create_dirs=create_dirs)
  File "C:\Python312\Lib\site-packages\tinydb\storages.py", line 32, in touch
    with open(path, 'a'):
         ^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/tmp/DefaultCreds_db.json'

Is there a way to fix that?

Database file path in home

Greetings,

First of all, thank you for this tool.

Do you think it would be possible to modify the creds database file location ? The current location is the main script location and it doesn't pair good with system such as NixOS where this location is marked as read only, wouldn't the home directory a better place maybe ?.

Regards.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    πŸ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. πŸ“ŠπŸ“ˆπŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❀️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.