In this lesson, we're going to talk about
default credentials
and how they can be used to perform network attacks
during a pen test.
Default credentials
are the pre-configured usernames and passwords
that come with many hardware devices
and software applications.
These credentials are meant to be changed
after installation, but often they are not
leaving systems vulnerable to attack.
Default Credentials are a common target for attackers
because they provide an easy way to gain unauthorized access
to systems and networks.
When conducting a penetration test,
one of the first things you should check for
is the use of default credentials.
Many devices and applications
come with well-known default credentials
that can be easily found online.
By attempting to log in using these credentials,
you can quickly identify weak points in the target network.
Imagine you're performing a pen test
on an organization's network.
By using a tool like Nmap,
you discover several network devices,
such as routers, switches, and IP cameras.
Knowing that these are types of devices
that often come with default credentials,
you attempt to log in
using the manufacturer's default username and passwords.
In some cases, you might find
the default credentials are still in use,
granting you administrative access to the device.
For example, many routers have default credentials
like admin for the username
and admin or password for the password.
By logging into the router with these credentials,
you can potentially change network settings,
use center information, or even redirect network traffic.
This level of access
can significantly compromise the security
of the entire network.
Here's an example of default passwords that I got
from a simple Google search
that led me to the website datarecovery.com.
In another scenario,
imagine you have accessed a network printer
using default credentials.
Many network printers have features
that allow them to store and forward scanned documents.
By accessing these features,
you could intercept sensitive documents
being scanned or printed.
Default credentials are not limited to network hardware.
Many software applications, databases,
and even web applications
come with default usernames and passwords.
For instance, MySQL databases
often have a default root account with no password
or a simple password like root.
If these credentials are not changed,
anyone with network access to the database
can gain full control over it.
Imagine you're testing a company's web app.
You try password spraying and using a word list
that contains a ton of default passwords
and discover that the backend database
still uses the default credentials.
By logging into the database with these credentials,
you gain access to all of the stored data,
which might include sensitive customer information,
financial records or company trade secret.
There are several tools available
that can help you automate the process
of finding and exploiting default credentials.
Tools like Hydra and Medusa can perform brute force attacks
using a list of common default usernames and passwords
against various services and devices.
These tools can save a ton of time
and increase the likelihood
of finding unsecured default credentials during a pen test.
Default credentials can also be exploited
for a lateral movement within a network.
Once you gain access to one device or application
using default credentials,
you can use the information and access gained
to move to other parts of the network.
For example, accessing a network switch
might allow you to intercept and analyze traffic,
which can reveal additional credentials
or network configurations that can be exported.
In 2013, attackers gained access to Target's network
by stealing credentials from a third party vendor,
Fazio Mechanical Services,
a refrigeration and HVAC contractor.
The attackers then used those stolen credentials
to access a Target server
that was used to store and manage vendor information.
This server unfortunately had default credentials,
so as a result, the attacker stole the credit card
and debit card information
of over 40 million Target customers,
as well as personal information,
which included names, addresses, phone numbers, et cetera,
of over 70 million customers.
So we see how our simple task
such as changing the default password
can spare a company from a ton of fines
and negative publicity.
So remember, default credentials
are a significant security risk
and a common target during a pen test.
They are pre-configured usernames and passwords
that should be changed after installation but often are not.
By checking for default credentials on network devices,
software applications and web applications,
you can identify weak points in a target network.
Exploiting default credentials
can grant administrative access, allowing lateral movement
and expose sensitive information.
Mastering the identification and exploitation
of default credentials will enhance your ability
to perform a thorough and effective pen test.