Skip to content
2 Free Scans
Learn about #SIGRed - the 17-year-old DNS vulnerability in Windows


Password Auditor – Find Weak Credentials

Find weak passwords in network services and web applications automatically

Scan Now
Sample Report | Use Cases | Technical Details

Sample Report

Here is a Password Auditor – Find Weak Credentials sample report:

  • Includes the network services which were found reachable
  • Shows the weak passwords that were found

Download Sample Report

Sample report

Password Auditor – Find Weak Credentials - Use Cases

The tool scans an IP address or hostname for network services that require authentication (ex. HTTP web forms, SSH, FTP, MYSQL, RDP, etc) and detects weak credentials by trying to login using a set of common usernames and passwords

Network Penetration Testing

The tool can be used to easily check if any common username/password was used in any network service. This could be an easy entry point into the network.

Self-assessment for Sysadmins

As a system administrator, you want to check if any of your users have set weak passwords on the services exposed to the internet. This verification should be done periodically.

Network Audit

When auditing the configuration settings of a network infrastructure, it is always needed to check the usage of default passwords (ex. cisco/cisco, admin/admin, etc).

Technical Details


About

Password Auditor is an autonomous password auditing solution for network services and web applications.

Its purpose is to automate the manual work performed when using tools such as Medusa, Hydra or Ncrack by automatically detecting the services which require authentication and launching the password audit with the right parameters.

One of the unique advantages of this tool is that it automatically detects web forms in web applications and it automatically attempts to login with default and weak credentials. It has the capability to detect if a web form authentication was performed with success or not.

As a result, you can easily find web interfaces with weak passwords (ex. Jenkins, Tomcat, PhpMyAdmin, Cisco routers, etc) together with network services as SSH, FTP, MySQL, MSSQL, RDP, etc, having default credentials.


Parameters

Parameter Description
Target This is the hostname or IP address to scan
Services Choose which services you want to audit (WWW, SSH, FTP, etc)
Advanced - Custom login URL Indicate a login URL where to perform web-form authentication attempts
Credentials Specify custom credentials to use when doing authentication attempts. All usernames and passwords are separated by a new line. Each list doesn’t have to exceed 20.000 characters and 1000 lines.


How it works

The Password Auditor starts by doing a port scan and service discovery against the target systems in order to discover which services require authentication.

The next step is to try common username/password combinations (taken from a predefined wordlist) for each service found in the previous step. In case the service is web based, Password Auditor automatically detects the login interfaces and parameters for authentication. The tool is capable of knowing if a web-form authentication was performed successfully or not.