Skip to main content

​
Overview

The Password Auditor tests network services and web applications for weak, default, or commonly used passwords. It automatically detects authentication interfaces and attempts to log in using provided wordlists. The Password Auditor is a vulnerability scanner: it actively tests for authentication weaknesses. It does not add data to your Attack Surface. Discovered weak credentials are reported as findings.

​
Supported targets

​
Supported services

SMB is disabled by default due to potential account lockout risks. Enable it explicitly when needed.

​
Attack types

​
Parameters comparison

Password testing can lock out accounts. Coordinate with system owners and understand lockout policies before testing. Use Password Spray mode for production systems.

​
Dictionary attack

Tests all combinations of usernames and passwords from the wordlists. Fastest approach but may trigger account lockouts on systems with lockout policies.

​
Password spray attack

Tests a limited number of passwords per username, then waits before trying more. Designed to avoid triggering account lockout policies.

​
Scan options

​
Port selection

The Top 100 list covers the most common ports for services the Password Auditor supports. See Port lists for the exact ports.

​
Wordlists

Create and manage custom wordlists in the Wordlists section. Custom wordlists allow you to include organization-specific terms, industry jargon, or credentials from previous breaches.
Build targeted wordlists using company name variations, product names, and patterns like Summer2024! or Company123. See Wordlists for wordlist management.

​
Additional options

​
How it works

The Password Auditor works in these steps:
  1. Port scanning: Identifies open ports running supported authentication services
  2. Service detection: Fingerprints services to determine authentication type
  3. Form detection: For HTTP, identifies login forms, fields, and success/failure indicators
  4. Default credentials: If enabled, tries known vendor defaults for detected products
  5. Wordlist testing: Attempts login with username/password combinations respecting attack type settings
  6. Reporting: Records successful authentications as findings
The Password Auditor automatically detects login forms in web applications like Jenkins, Tomcat Manager, phpMyAdmin, and router admin interfaces.

​
Follow-up actions

After discovering weak credentials:
  • Change passwords immediately: Weak credentials are critical findings
  • Implement password policies: Enforce complexity and length requirements
  • Enable account lockout: Prevent brute force attacks
  • Deploy MFA: Add multi-factor authentication where possible
  • Run Network Scanner: Check for additional vulnerabilities
  • Run Port Scanner: Discover additional services to audit