Testing default credentials in web applications
Default credentials are often forgotten in web applications and devices. Nmap's NSE script http-default-accounts automates the process of testing default credentials in popular web applications, such as Apache Tomcat Manager, Cacti, and even the web management interfaces of home routers.
This recipe shows you how to automatically test default credential access in several web applications by using Nmap.
How to do it...
To automatically test default credential access in the supported applications, use the following Nmap command:
$ nmap -p80 --script http-default-accounts <target>
The results will indicate the application and default credentials if successful:
PORT STATE SERVICE REASON 80/tcp open http ...
Get Nmap 6: Network Exploration and Security Auditing Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
