To automatically test default credential access in the supported applications, use the following Nmap command:

$ nmap -p80 --script http-default-accounts <target>

The results will indicate the application and default credentials if successful:

PORT   STATE SERVICE REASON
80/tcp open  http    syn-ack
|_http-default-accounts: [Cacti] credentials found -> admin:admin Path:/cacti/

We initiate the NSE script http-default-accounts (--script http-default-accounts) if a web server is found on port 80 (-p80).

I developed this NSE script to save time during web penetration tests, by automatically checking if system administrators have forgotten to change any default passwords in their systems. I've included a few fingerprints for popular services, but this script can be improved a lot by supporting more services. I encourage you to submit new fingerprints to its database, if you have access to a service commonly left with default credential access. The supported services so far are:

The script detects web applications by looking at known paths and initiating a login routine using the stored, default credentials. It depends on a fingerprint file located at /nselib/data/http-default-accounts.nse. Entries are LUA tables and they look like the following:

table.insert(fingerprints, {
  name = "Apache Tomcat",
  category = "web",
  paths = {
    {path = "/manager/html/"},
    {path = "/tomcat/manager/html/"}
  },
  login_combos = {
    {username = "tomcat", password = "tomcat"},
    {username = "admin", password = "admin"}
  },
  login_check = function (host, port, path, user, pass)
    return try_http_basic_login(host, port, path, user, pass)
  end
})

Each fingerprint entry must have the following fields:

For less intrusive scans, filter out probes by category by using the script argument http-default-accounts.category:

$ nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=routers <target>

The available categories are:

This script uses the root folder as the base path by default, but you can set a different one by using the argument http-default-accounts.basepath:

$ nmap -p80 --script http-default-accounts --script-args http-default-accounts.basepath=/web/ <target>

The default fingerprint file is located at /nselib/data/http-default-accounts-fingerprints.lua, but you can use a different file by specifying the argument http-default-accounts.fingerprintfile:

$ nmap -p80 --script http-default-accounts --script-args http-default-accounts.fingerprintfile=./more-signatures.txt <target>

$ nmap -p80 --script http-brute --script-args http.useragent="Mozilla 42" <target>