Nowadays, web
applications used are open source and/or extremely popular and relatively well
known. They also require some type of
minimal configuration by the user to be properly setup. Unfortunately, plenty
of people misconfigure their web apps leading to certain security issues. For
example, certain web applications come with a default username and password.
Part of the configuration process is to delete this username and password and
create another administrator account.
People don't like doing this and thus a lot of web applications exists
with default usernames and password ready for some attacker to completely take
control of it.
Some common
usernames and passwords are listed below:
- Usernames
- Admin, administrator, root, system, guest, operator, super, qa, test, test1, testing.
- Passwords
- <completely blank password>, password, pass123, password123, admin, guest.
Some times,
usernames are named after the application it self. So if we are trying to
penetrate an application called "SystemKeeper" - one should try systemkeeper as a username
and perhaps also the password. Another
way to do find a password is looking at the source. Poorly programmed
applications might have the username
visible in the source.
CIRT, GovermentSecurity.org,
and virus.org provides the
default usernames and password for various applications and devices.
