Default Credentials

Detects use of common default usernames and passwords in application configuration and code.

zakirkun 6de8e17 2 files · 3.5 KB Updated

File contents

Default Credentials

Overview

Default credentials are pre-configured usernames and passwords that ship with software, databases, or infrastructure components. Attackers maintain databases of default credentials and routinely attempt them. Common examples:

  • admin:admin, admin:password, root:root
  • Database defaults: mysql root:"", postgres postgres:postgres
  • IoT/Router defaults: admin:1234, admin:admin

Remediation

  • Change all default credentials immediately upon installation
  • Enforce strong, unique passwords for administrative accounts
  • Use secrets management systems for credentials in code
  • Detect default credentials in CI/CD pipelines

zakirkun/ice-tea/tree/main/skills/infra/default-credentials commit 6de8e17b50

Frequently asked questions

npx skillmds@latest add zakirkun/default-credentials