Skip to main content
Before brute-forcing or cracking anything, check whether the device or application in front of you was simply never reconfigured from its factory login. Routers, IoT devices, admin panels for niche software, and management interfaces are the most common offenders, this takes seconds and is worth ruling out first on every new service found during enumeration.
The underlying CSV dataset is also browsable directly on GitHub when the tool itself isn’t installed.
SecLists’ default-passwords directory covers a similar list in plain wordlist form, this is also very useful when using bruteforcing tools

​
Quick Reference Tools

DefaultCreds-Cheat-Sheet

Searchable database of default credentials by vendor/product.

SecLists: Default Credentials

The same kind of data as plain wordlists, for automated spraying.