Default Credentials Lab

Default Credentials — The Low-Hanging Fruit of Pentesting

What Are Default Credentials?

Default credentials are the username and password combinations that software products, hardware devices, and online services ship with for initial access. They exist because something must be accessible before an operator can set their own credentials — a router must be configurable on first power-on, a web console must be reachable before it can be secured.

The security problem is not that these credentials exist. The problem is that they frequently remain unchanged after deployment.

The Scale of the Problem

According to CISA (the US Cybersecurity and Infrastructure Security Agency), exploitation of default credentials is one of the most common techniques observed across incident response engagements. In their 2023 Secure-by-Design guidance, CISA identified the elimination of default credentials as one of three core requirements for software manufacturers.

Default credentials are so pervasive that public databases catalogue thousands of them. The DefaultCreds-cheat-sheet project lists known username and password pairs for everything from enterprise CI/CD systems and network switches to IP cameras and consumer routers. Nmap — the industry-standard network scanner — ships with a script that automatically tests HTTP administrative interfaces against a built-in list of known defaults.

The Mirai Botnet: A Case Study in Scale

In 2016, the Mirai botnet demonstrated the industrial-scale consequences of unchanged default credentials. Mirai scanned the entire IPv4 address space (all 4.3 billion addresses) looking for devices with Telnet or SSH open. When it found one, it tried approximately 60 known default credential pairs in sequence.

The result: over 600,000 compromised devices — routers, IP cameras, DVRs, baby monitors — all infected without any exploitation of a code-level vulnerability. Once assembled, the botnet launched distributed denial-of-service attacks that disrupted internet access for millions of users across the eastern United States, taking down DNS providers and major websites in the process.

Mirai required no sophisticated exploitation. It required only a list of factory passwords that users had never changed.

Services Commonly Found with Default Credentials

These services are frequently deployed on internal networks with the assumption that perimeter security provides adequate protection. This assumption fails when an attacker gains any foothold inside the network — through phishing, a VPN vulnerability, or a single internet-facing exposure.

The Attacker's Workflow

Default credential attacks are simple and fast:

1. Discover the service using network scanning (Nmap) or internet search engines (Shodan, Censys).
2. Identify the product and version from banners, HTTP headers, or page titles.
3. Look up the known default credentials from public databases or official documentation.
4. Attempt login — typically one to five credential pairs.
5. Gain access with full administrative privileges in most cases.
6. Pivot to adjacent systems, exfiltrate data, or deploy persistent backdoors.

What You Will Do in This Lab

The interactive panel on the right simulates administrative login interfaces for several common enterprise services. You will:

1. Select a target service and review its version information.
2. Use the "Show known defaults" hint to discover candidate credential pairs.
3. Test credentials against the simulated login form.
4. Identify the working credential pair for Jenkins.
5. Submit the successful credential pair to complete the exercise.

By the end of this lab, you will understand why default credentials represent critical risk even on internal networks, and how to eliminate them from your own deployments.