From 06adbe2e0825c5edc5405969cbc1675d28645a68 Mon Sep 17 00:00:00 2001 From: "Tim Shelton (redsand)" Date: Mon, 24 Jul 2023 19:30:44 +0000 Subject: [PATCH 01/19] Feature to add testing of default credentials. still need to include the data in reporting modified: EyeWitness.py modified: modules/helpers.py modified: modules/objects.py modified: modules/selenium_module.py modified: signatures.txt --- Python/EyeWitness.py | 5 + Python/modules/helpers.py | 29 +- Python/modules/objects.py | 75 ++- Python/modules/selenium_module.py | 366 +++++++++++++- Python/signatures.txt | 796 +++++++++++++++--------------- 5 files changed, 860 insertions(+), 411 deletions(-) diff --git a/Python/EyeWitness.py b/Python/EyeWitness.py index 926b8917..76b17014 100755 --- a/Python/EyeWitness.py +++ b/Python/EyeWitness.py @@ -9,6 +9,7 @@ import sys import time import webbrowser +import json from modules import db_manager from modules import objects @@ -260,6 +261,7 @@ def worker_thread(cli_parsed, targets, lock, counter, user_agent=None): if cli_parsed.web: create_driver = selenium_module.create_driver capture_host = selenium_module.capture_host + auth_host = selenium_module.auth_host with lock: driver = create_driver(cli_parsed, user_agent) @@ -293,12 +295,15 @@ def worker_thread(cli_parsed, targets, lock, counter, user_agent=None): cli_parsed, http_object, driver) if http_object.category is None and http_object.error_state is None: http_object = default_creds_category(http_object) + auth_host(cli_parsed, http_object, driver) + manager.update_http_object(http_object) else: ua_object, driver = capture_host( cli_parsed, http_object, driver) if http_object.category is None and http_object.error_state is None: ua_object = default_creds_category(ua_object) + auth_host(cli_parsed, http_object, driver) manager.update_ua_object(ua_object) counter[0].value += 1 diff --git a/Python/modules/helpers.py b/Python/modules/helpers.py index d681058c..1d7bbdbb 100644 --- a/Python/modules/helpers.py +++ b/Python/modules/helpers.py @@ -640,7 +640,7 @@ def do_jitter(cli_parsed): sleep_value = sleep_value * .01 sleep_value = 1 - sleep_value sleep_value = sleep_value * cli_parsed.jitter - print("[*] Sleeping for " + str(sleep_value) + " seconds..") + print("[*] Sleeping for " + "{:.2f}".format(sleep_value) + " seconds..") try: time.sleep(sleep_value) except KeyboardInterrupt: @@ -752,9 +752,24 @@ def default_creds_category(http_object): for sig in signatures: # Find the signature(s), split them into their own list if needed # Assign default creds to its own variable + # !! added support for description field and cred field, so that creds can be + # !! automatically checked + sig = sig.rstrip("\n") sig_cred = sig.split('|') + if len(sig_cred) > 3: + # character '|' is contained in the page_sig, rejoin and work backwards + tmp_sig = sig_cred[0:len(sig_cred)-2] + sig = "|".join(tmp_sig) + sig_cred2 = [ sig, sig_cred[len(sig_cred) - 2], sig_cred[len(sig_cred) - 1] ] + sig_cred = sig_cred2 + page_sig = sig_cred[0].split(";") - cred_info = sig_cred[1].strip() + desc = sig_cred[1].strip() + try: + cred_info = sig_cred[2] + except Exception as e: + # default to description, assume description is missing + cred_info = desc # Set our variable to 1 if the signature was not identified. If it is # identified, it will be added later on. Find total number of @@ -765,10 +780,12 @@ def default_creds_category(http_object): # web page needed to make a signature Delimete the "signature" # by ";" before the "|", and then have the creds after the "|" if all([x.lower() in http_object.source_code.decode().lower() for x in page_sig]): + http_object._description = desc + if http_object.default_creds is None: http_object.default_creds = cred_info else: - http_object.default_creds += '\n' + cred_info + http_object.default_creds += ';' + cred_info for cat in categories: # Find the signature(s), split them into their own list if needed @@ -809,6 +826,12 @@ def default_creds_category(http_object): if '404 Not Found' in http_object.page_title: http_object.category = 'notfound' + + """ + if True and len(http_object._parsed_creds) > 0: + print("Attempting authentication") + """ + return http_object except IOError: print("[*] WARNING: Credentials file not in the same directory" diff --git a/Python/modules/objects.py b/Python/modules/objects.py index 49028e24..362ebc83 100644 --- a/Python/modules/objects.py +++ b/Python/modules/objects.py @@ -1,6 +1,7 @@ import html import os import re +import traceback from modules.helpers import strip_nonalphanum @@ -30,6 +31,10 @@ def __init__(self): self._ua_left = None self._resolved = None + # parsed authentication, tuple of username and password, if username is empty it will be None + self._description = "" + self._parsed_creds = [ ] + def set_paths(self, outdir, suffix=None): file_name = self.remote_system.replace('://', '.') for char in [':', '/', '?', '=', '%', '+']: @@ -179,7 +184,47 @@ def default_creds(self): @default_creds.setter def default_creds(self, default_creds): + if not default_creds: return + + # attempt to parse + # filter out those without '/' or start with '(' # save as comment only + if not '/' in default_creds or default_creds[0] == '(': + self._parsed_creds = [ (None, None, default_creds, None) ] # no user or pass, only comment + self._default_creds = default_creds + return + + try: + creds = default_creds.split(';') + # parse out those with comments if present + # else split / + for c in creds: + user = passwd = comment = None + if ' (' in c: + x = c.split(' (') + comment = x[1][:-1].strip() # assuming ending ) and removing it + y = x[0].split('/') + user = y[0].strip() + try: + passwd = y[1].strip() + except: + # print("Only 1 value found: ", passwd) + passwd = None + else: + y = c.split('/') + user = y[0].strip() + try: + passwd = y[1].strip() + except: + # print("Only 1 value found: ", passwd) + passwd = None + self._parsed_creds = self._parsed_creds + [ (user,passwd,comment,None) ] + except Exception as e: + print("[!] Failed to parse credentials: ", e) + print(" ", default_creds) + print(traceback.format_exc()) self._default_creds = default_creds + #print("DEF CREDS: ", default_creds) + #print("PAR CREDS: ", self._parsed_creds) @property def category(self): @@ -227,13 +272,29 @@ def create_table_html(self): self.remote_system) if self.default_creds is not None: - try: - html += "
Default credentials: {0}
".format( - self.sanitize(self.default_creds)) - except UnicodeEncodeError: - html += u"
Default credentials: {0}
".format( - self.sanitize(self.default_creds)) - + if type(self.default_creds) is list: + try: + html += "
Default credentials: {0} ({1})
".format( + self.sanitize(self._description), self.sanitize(", ".join(self.default_creds))) + except UnicodeEncodeError: + try: + html += u"
Default credentials: {0} ({1})
".format( + self.sanitize(self._description), self.sanitize(self.default_creds)) + except: + print('[!] Failed to format default credentials: ') + print(json.dumps(self.default_creds)) + else: + try: + html += "
Default credentials: {0} ({1})
".format( + self.sanitize(self._description), self.sanitize(self.default_creds)) + except UnicodeEncodeError: + try: + html += u"
Default credentials: {0} ({1})
".format( + self.sanitize(self._description), self.sanitize(self.default_creds)) + except: + print('[!] Failed to format default credentials: ') + print(json.dumps(self.default_creds)) + if self.error_state is None: try: html += "\n
Page Title: {0}\n".format( diff --git a/Python/modules/selenium_module.py b/Python/modules/selenium_module.py index afdb39f8..9cab3d2f 100644 --- a/Python/modules/selenium_module.py +++ b/Python/modules/selenium_module.py @@ -2,8 +2,10 @@ import os import socket import sys +import traceback import urllib.request import urllib.error +from urllib.parse import urlparse import ssl try: @@ -12,8 +14,11 @@ from ssl import SSLError as sslerr try: + # from seleniumwire import webdriver from selenium import webdriver from selenium.webdriver.firefox.options import Options + from selenium.webdriver.common.keys import Keys + from selenium.webdriver.common.by import By from selenium.common.exceptions import NoAlertPresentException from selenium.common.exceptions import TimeoutException from selenium.common.exceptions import UnexpectedAlertPresentException @@ -89,6 +94,360 @@ def create_driver(cli_parsed, user_agent=None): sys.exit() +def _auth_host_uri(cred, cli_parsed, http_object, driver, ua=None): + """Performs the internal authentication with single given credential + + Args: + cred (Tuple): Consists of username, password, comment, and status result once tested (bool) + cli_parsed (ArgumentParser): Command Line Object + http_object (HTTPTableObject): Object containing data relating to current URL + driver (FirefoxDriver): webdriver instance + ua (String, optional): Optional user agent string + + Returns: + Boolean: True for success, and False for failure + """ + + # first attempt for each cred, attempt cred call ie: https://username:password@hostname:port/ + # if result is unauthorized or a form is found with a password input (assuming failure) + + p = urlparse(http_object.remote_system) + if cred[0] and cred[1]: + auth_url = p.scheme + "://" + cred[0] + ":" + cred[1] + "@" + p.netloc + p.path + elif cred[0]: + auth_url = p.scheme + "://" + cred[0] + ":@" + p.netloc + p.path + else: + print("[*] No credentials found, skipping...") + # print(cred) + # auth_url = p.scheme + "://" + p.netloc + p.path + return False + print("[*] Attempting authentication via url: ", auth_url) + + # Attempt to take the screenshot + try: + # If cookie is presented we need to avoid cookie-averse error. To do so, we need to get the page twice. + driver.get(auth_url) + + # if a text input and a password input are shown, print content, and assume login failed + + try: + elem = driver.find_element('xpath', "//input[@type='password']") + except WebDriverException as e: + print("[!] AUTH SUCCESS: No password element found, potential auth success: {0}".format(http_object.remote_system)) + # Save our screenshot to the specified directory + try: + filename = http_object.screenshot_path[:-4] + ".auth.1.png" + print("[!] Saving screenshot to: ", filename) + print(driver.save_screenshot(filename)) + except WebDriverException as e: + print('[*] Error saving web page screenshot' + ' for ' + http_object.remote_system) + + # get contents and inspect + if cli_parsed.cookies is not None: + for cookie in cli_parsed.cookies: + driver.add_cookie(cookie) + + driver.get(auth_url) + # get contents and inspect again + try: + elem = driver.find_element('xpath', "//input[@type='password']") + except WebDriverException as e: + print("[!] AUTH SUCCESS: No password element found, potential auth success: {0}".format(http_object.remote_system)) + # Save our screenshot to the specified directory + try: + filename = http_object.screenshot_path[:-4] + ".auth.2.png" + print("[!] Saving screenshot to: ", filename) + print(driver.save_screenshot(filename)) + except WebDriverException as e: + print('[*] Error saving web page screenshot' + ' for ' + http_object.remote_system) + return True + + return False + + except KeyboardInterrupt: + print('[*] Skipping: {0}'.format(http_object.remote_system)) + http_object.error_state = 'Skipped' + http_object.page_title = 'Page Skipped by User' + except TimeoutException: + print('[*] Hit timeout limit when connecting to {0}, retrying'.format(http_object.remote_system)) + except http.client.BadStatusLine: + print('[*] Bad status line when connecting to {0}'.format(http_object.remote_system)) + except WebDriverException as e: + print('[*] WebDriverError when connecting to {0}'.format(http_object.remote_system)) + # print('[*] WebDriverError when connecting to {0} -> {1}'.format(http_object.remote_system, e)) + except Exception as e: + print("[*] URI login failure: ", e) + print(traceback.format_exc()) + + # Dismiss any alerts present on the page + # Will not work for basic auth dialogs! + try: + alert = driver.switch_to.alert + alert.dismiss() + except Exception as e: + pass + + return False + +def _auth_host_form(cred, cli_parsed, http_object, driver, ua=None): + """Performs the internal authentication with single given credential + + Args: + cred (Tuple): Consists of username, password, comment, and status result once tested (bool) + cli_parsed (ArgumentParser): Command Line Object + http_object (HTTPTableObject): Object containing data relating to current URL + driver (FirefoxDriver): webdriver instance + ua (String, optional): Optional user agent string + + Returns: + Boolean: True for success, and False for failure + Driver: Needed since this functions closes connections and retries + """ + + # form is found, leverage selenium + + # selenium: for each form: + # find forms that contain password input type. + # form: provide each user/password and confirm non 400 return + + print("[!] Attempting form validation...") + try: + success=False + + # If cookie is presented we need to avoid cookie-averse error. To do so, we need to get the page twice. ??? + + driver2 = create_driver(cli_parsed, ua) + driver2.get(http_object.remote_system) + if cli_parsed.cookies is not None: + for cookie in cli_parsed.cookies: + driver2.add_cookie(cookie) + driver2.get(http_object.remote_system) + + # get contents and inspect again + # for each form that contains an input + try: + forms = driver2.find_elements('xpath', "//form") + except WebDriverException: + print('[*] WebDriverError when connecting to {0} -> {1}'.format(http_object.remote_system, e)) + print('[*] No forms have been found! Exiting.') + return False + + # print("FORMS: ", forms) + print("[!] %d forms found..." % len(forms)) + i = 0 + for form in forms: + # for each radio button, for each radio button option + + # get contents and inspect again + # for each form that contains an input + radios = [ ] + try: + radios = form.find_elements('xpath', "//input[@type='radio']") + except WebDriverException: + pass + + if len(radios) > 0: + # print("[*] Testing additional radio input found in form (radio #%d)" % radioOffset) + # radios[radioOffset].click() + # radioOffset += 1 + for radio in radios: + i = i + 1 + radio.click() + # submit + + i = i + 1 + try: + pass_elem = form.find_element('xpath', "//input[@type='password']") + if pass_elem: + pass_elem.send_keys(cred[1]) + except WebDriverException: + print("[*] No password input found in form, skipping form...") + continue + + try: + user_elem = form.find_element('xpath', "//input[@type='input']") + user_elem.send_keys(cred[0]) + except WebDriverException: + print('[*] No username element found, attempting to send password only.') + + try: + form.find_element('xpath', "//input[@type='submit']").click() + except WebDriverException: + print('[*] No submit input element found, attempting to give up.') + try: + form.submit() + except Exception as e: + print('[!] Unable to submit form: ', e) + + try: + elem = driver2.find_element('xpath', "//input[@type='password']") + print('[*] Authentication failure.') + except WebDriverException: + print("[!] AUTH SUCCESS(2): No password element found, potential auth success!") + success=True + # Save our screenshot to the specified directory + try: + filename = http_object.screenshot_path[:-4] + ".auth.3_%d.png" % i + print("[!] Saving screenshot to: ", filename) + print(driver2.save_screenshot(filename)) + except WebDriverException as e: + print('[*] Error saving web page screenshot' + ' for ' + http_object.remote_system) + + # Dismiss any alerts present on the page + # Will not work for basic auth dialogs! + try: + alert = driver2.switch_to.alert + alert.dismiss() + except Exception as e: + pass + + driver2.back() + + else: + + i = i + 1 + try: + pass_elem = form.find_element('xpath', "//input[@type='password']") + if pass_elem: + pass_elem.send_keys(cred[1]) + except WebDriverException: + print("[*] No password input found in form, skipping form...") + continue + + try: + user_elem = form.find_element('xpath', "//input[@type='input']") + user_elem.send_keys(cred[0]) + except WebDriverException: + print('[*] No username element found, attempting to send password only.') + + try: + form.find_element('xpath', "//input[@type='submit']").click() + except WebDriverException: + print('[*] No submit input element found, attempting to give up.') + try: + form.submit() + except Exception as e: + print('[!] Unable to submit form: ', e) + + try: + elem = driver2.find_element('xpath', "//input[@type='password']") + print('[*] Authentication failure.') + except WebDriverException: + print("[!] AUTH SUCCESS(2): No password element found, potential auth success!") + success=True + # Save our screenshot to the specified directory + try: + filename = http_object.screenshot_path[:-4] + ".auth.3_%d.png" % i + print("[!] Saving screenshot to: ", filename) + print(driver2.save_screenshot(filename)) + except WebDriverException as e: + print('[*] Error saving web page screenshot' + ' for ' + http_object.remote_system) + + # Dismiss any alerts present on the page + # Will not work for basic auth dialogs! + try: + alert = driver2.switch_to.alert + alert.dismiss() + except Exception as e: + pass + + driver2.back() + + + driver2.quit() + + return success + except KeyboardInterrupt: + print('[*] Skipping: {0}'.format(http_object.remote_system)) + http_object.error_state = 'Skipped' + http_object.page_title = 'Page Skipped by User' + except TimeoutException: + print('[*] Hit timeout limit when connecting to {0}, retrying'.format(http_object.remote_system)) + except http.client.BadStatusLine: + print('[*] Bad status line when connecting to {0}'.format(http_object.remote_system)) + except WebDriverException: + print('[*] WebDriverError when connecting to {0}'.format(http_object.remote_system)) + # print('[*] WebDriverError when connecting to {0} -> {1}'.format(http_object.remote_system, e)) + except Exception as e: + print("[*] Form login failure: ", e) + print(traceback.format_exc()) + + + return False + +def _auth_host(cred, cli_parsed, http_object, driver, ua=None): + """Performs the internal authentication with single given credential + + Args: + cred (Tuple): Consists of username, password, comment, and status result once tested (bool) + cli_parsed (ArgumentParser): Command Line Object + http_object (HTTPTableObject): Object containing data relating to current URL + driver (FirefoxDriver): webdriver instance + ua (String, optional): Optional user agent string + + Returns: + Boolean: True for success, and False for failure + """ + + # first attempt for each cred, attempt cred call ie: https://username:password@hostname:port/ + # if result is unauthorized or a form is found with a password input (assuming failure), try next request + # else if form is found, leverage selenium + + # selenium: for each form: + # find forms that contain password input type. + # form: provide each user/password and confirm non 400 return + + if _auth_host_uri(cred, cli_parsed, http_object, driver, ua): + print("[!] Verified using uri request") + return True + + print("[!] URL Authentication method failed, attempting form authentication") + + return _auth_host_form(cred, cli_parsed, http_object, driver, ua) + + +def auth_host(cli_parsed, http_object, driver, ua=None): + """Attempts to authenticate to a single host, given + the data available in http_object._parsed_creds + + Args: + cli_parsed (ArgumentParser): Command Line Object + http_object (HTTPTableObject): Object containing data relating to current URL + driver (FirefoxDriver): webdriver instance + ua (String, optional): Optional user agent string + + Returns: + HTTPTableObject: Complete http_object + """ + + + if len(http_object._parsed_creds) == 0: + print("[!] Failed to test authentication, no credentials have been found: ", http_object.default_creds) + return http_object + + for idx in range(len(http_object._parsed_creds)): + c = http_object._parsed_creds[idx] + s = "" + if c[0] and c[1]: + s += "User: %s Password: %s" % (c[0], c[1]) + elif c[0]: + s += "User: %s Password: empty" % c[0] + if c[2]: + s += " Comment: %s" % c[2] + s += "\n" + + if _auth_host(c, cli_parsed, http_object, driver, ua): + print("[*] Authentication Success! Credentials:\n%s" % s.strip("\n")) + c = list(c) + c[3] = True + http_object._parsed_creds[idx] = tuple(c) + + return http_object + def capture_host(cli_parsed, http_object, driver, ua=None): """Screenshots a single host, saves information, and returns a complete HTTP Object @@ -124,7 +483,8 @@ def capture_host(cli_parsed, http_object, driver, ua=None): print('[*] Bad status line when connecting to {0}'.format(http_object.remote_system)) http_object.error_state = 'BadStatus' return http_object, driver - except WebDriverException: + except WebDriverException as e: + # print('[*] WebDriverError when connecting to {0} -> {1}'.format(http_object.remote_system, e)) print('[*] WebDriverError when connecting to {0}'.format(http_object.remote_system)) http_object.error_state = 'BadStatus' return http_object, driver @@ -169,8 +529,8 @@ def capture_host(cli_parsed, http_object, driver, ua=None): http_object.error_state = 'BadStatus' return_status = True break - except WebDriverException: - print('[*] WebDriverError when connecting to {0}'.format(http_object.remote_system)) + except WebDriverException as e: + print('[*] WebDriverError when connecting to {0} -> {1}'.format(http_object.remote_system, e)) http_object.error_state = 'BadStatus' return_status = True break diff --git a/Python/signatures.txt b/Python/signatures.txt index 1ca1e718..39983780 100644 --- a/Python/signatures.txt +++ b/Python/signatures.txt @@ -1,427 +1,427 @@ -Integrated Dell Remote Access Controller|(Dell iDRAC) root/calvin -ACE 4710 Device Manager;Cisco|(ACE 4710 Device Manager) admin/admin -ATutor;form_login_action;/gad_search.php|(ATutor Web CMS) admin/admin or instructor/instructor -Apache Lenya;lenya.action=introspect|(Apache Lenya) admin/levi -Polycom RSS 2000|(Polycom RSS 2000) Administrator/polycom -Polycom;HDX 8000 HD|(Polycom HDX 8000) admin/ -Drupal.settings|(Drupal) admin/ -var daisy;daisy.site;daisy.site.name|(Daisy CMS) admin/admin or user/user -Hewlett-Packard Development Company;iLO.init|(HP iLo) Administrator/ -;;;|(Dell Generic Signature)No default username or pass -Dell Color Laser 5110cn|(Dell Color Laser 5110cn) No default username or pass -Dell Laser Printer 1700n|(Dell Laser Printer 1700n) No default username or pass -Dell Laser Printer 1720dn|(Dell Laser Printer 1720dn) No default username or pass -Dell B5465dnf;/cgi-bin/dynamic/dell_header.html|(Dell B5465dnf) No default username or pass -Dell B3465dnf Laser MFP;/cgi-bin/dynamic/dell_header.html|(Dell b3465dnf) No default username or pass -Dell Laser Printer 3000cn;frame src="status/status.htm" name="RightFrame"|(Dell 3000cn) No default username or pass -Xerox WorkCentre 7435;function restore_saved_params(form, key_html)|(Xerox WorkCentre 7435) admin/1111 -WorkCentre 7120;Fuji Xerox Co;var biItms|(WorkCentre 7120) admin/1111 -WorkCentre 7125;Fuji Xerox Co;var nvTree|(WorkCentre 7125) admin/1111 -Xerox WorkCentre 5225;inNN;var trItms|(Xerox WorkCentre 5225) 11111/x-admin -Xerox Corporation;XEROX WORKCENTRE;Header Frame;inUriToMatch|(Potential Generic Xerox) admin/1111 or x-admin/11111 -Xerox Workstation M20i;var HEADER_FRAME;var BRANDING_FRAME|(Xerox Workstation M20i) admin/1111 -ChangeDefWebLanguage();script/cookieCoke.js;script/Common_script.js;NOSCRIPT|(Potential Workcenter 3550) admin/1111 -WorkCentre 6605DN;frame src="menuhome.htm"|(WorkCentre 6605DN) No default pass -Xerox WorkCentre 7232;var nvTree;var rSec|(Xerox WorkCentre 7232) 11111/x-admin -Xerox WorkCentre 5325;var nvTree;var csItms|(Xerox WorkCentre 5325) admin/1111 -Xerox WorkCentre 7345;var nvTree;var csItms|(Xerox WorkCentre 7345) admin/1111 or 11111/x-admin -Dell Color Laser 3110cn;frameleft.htm;TopFrame|(Dell Laser 3110cn) No Default Username or Pass -HP LaserJet Pro MFP M521dn;setupUrls[index++];manageUrls|(HP MFP M521dn) No default username or pass -HP Color LaserJet CM2320nf MFP;applicationMastheadSmall|(HP Color LaserJet CM2320nf) No default username or pass -HP LaserJet M1522n MFP;mastheadIcon|(HP LaserJet M1522n) No default username or pass -HP LaserJet M1536dnf;buttonManager.js;mastheadIcon|(HP LaserJet M1536dnf) No default username or pass -HP LaserJet M2727nf MFP;mastheadIcon;mastheadTitle|(HP LaserJet M2727nf) No default username or pass -HP LaserJet 1536dnf MFP;mastheadIcon;mastheadTitle|(HP LaserJet 1536dnf) No default username or pass -HP Color LaserJet CM4540 MFP;class="device-name"|(HP Color LaserJet CM4540) No default username or pass (potential username admin, no pass) -Synology DiskStation - Monego;DiskMessageHandler;VideoPlayer|(Synology) admin/ -Brother MFC-8480DN;Brother Industries;OpenConfirmWindow|(Brother 8480DN) /access or admin/access -HP LaserJet 700 color MFP M775;/hp/device/ControlPanelCustomization/Index|(HP LaserJet 700) No default username or pass -MB471;okilogo;replacelogo;savecolor|(OKI MB471) /aaaaaa or 000000 or 0000 or root/(last 6 of mac address Uppercased) -MB461;okilogo;var pagename;var status_ad_flag|(OKI MB461) /aaaaaa or 000000 or 0000 or root/(last 6 of mac address Uppercased) -dlink;document.login_form.f_LOGIN_NAME.value!="admin";document.login_form.f_login_type.value=0;function checkID()|(DNS-323 or DNS-343) admin/ -var re=/root;anonymous;nobody;administrator;ftp;guest;squeezecenter;sshd;messagebus;netdev/i;var cUName = $.cookie('uname');var cPwd = $.cookie('password');/cgi-bin/login_mgr.cgi|(Potential DNS-320L NAS) admin/ or admin/ -APC;Log On;function isValidBrowser();APC Website;var nAgt|(Potential APC SmartUPS) apc/apc -;var RVL_str = "NULL";var RVL_decode_flg = "0";frameset rows="*";src="/configuration/cover_frame" scrolling="no"|(Potential IPmux-216) su/1234 or user/1234 or tech/1234 -Avaya Aura; System manager 6.1;div class="legalNoticeDiv";div class="loginouterdiv"|(Avaya Aura System Manager 6.1) admin/admin123 -hp LaserJet 1320 series;var ieVSupported = "MSIE 5.0";hp/device/banner.html|(HP LaserJet 1320 series) -hp LaserJet 4250;a.hpButtonNavigationLink;div.hpConsumableBlockData|(HP LaserJet 4250) -hp color LaserJet 4600;images/hp_invent_logo.gif;jsfiles/formatting.css|(HP LaserJet 4600) -HP Color LaserJet CP2025;td class="mastheadIcon";applicationMastheadSmall|(HP LaserJet CP2025) -Rainwise IP-100;Relative Humidity;Solar Rad;Leaf Wetness;var exdate=new Date()|(Rainwise IP-100) admin/admin, admin/paradox, or paradox/paradox -WebDVR;var ip;var pwd;login.sitecode.value;DX8100|(DX8100 Web DVR) admin/admin -DYMO LabelWriter Print Server;InternetExplorer3.0(or later)|(DYMO LabelWriter Print Server) admin/admin -HP System Management Homepage Login;Check if the user is already connected;pageColumns|(HP System Management) username and pass of OS or domain account -Polycom RMX 1000;ondragstart;cfg_ui_hide;proxy_log_ip|(Polycom RMX 1000) POLYCOM/POLYCOM -Sign In - Hyperic;body class="tundra";since dojo has trouble when;screencastLink|hqadmin/hqadmin -HP System Management Homepage;HP-UX removed;Unable to create a socket to communicate|(HP System Management) username and pass of OS or domain account +Integrated Dell Remote Access Controller|(Dell iDRAC)|root/calvin +ACE 4710 Device Manager;Cisco|(ACE 4710 Device Manager)|admin/admin +ATutor;form_login_action;/gad_search.php|(ATutor Web CMS)|admin/admin;instructor/instructor +Apache Lenya;lenya.action=introspect|(Apache Lenya)|admin/levi +Polycom RSS 2000|(Polycom RSS 2000)|Administrator/polycom +Polycom;HDX 8000 HD|(Polycom HDX 8000)|admin/ +Drupal.settings|(Drupal)|admin/ +var daisy;daisy.site;daisy.site.name|(Daisy CMS)|admin/admin;user/user +Hewlett-Packard Development Company;iLO.init|(HP iLo)|Administrator/ +;;;|(Dell Generic Signature)No default username/pass +Dell Color Laser 5110cn|(Dell Color Laser 5110cn)|No default username/pass +Dell Laser Printer 1700n|(Dell Laser Printer 1700n)|No default username/pass +Dell Laser Printer 1720dn|(Dell Laser Printer 1720dn)|No default username/pass +Dell B5465dnf;/cgi-bin/dynamic/dell_header.html|(Dell B5465dnf)|No default username/pass +Dell B3465dnf Laser MFP;/cgi-bin/dynamic/dell_header.html|(Dell b3465dnf)|No default username/pass +Dell Laser Printer 3000cn;frame src="status/status.htm" name="RightFrame"|(Dell 3000cn)|No default username/pass +Xerox WorkCentre 7435;function restore_saved_params(form, key_html)|(Xerox WorkCentre 7435)|admin/1111 +WorkCentre 7120;Fuji Xerox Co;var biItms|(WorkCentre 7120)|admin/1111 +WorkCentre 7125;Fuji Xerox Co;var nvTree|(WorkCentre 7125)|admin/1111 +Xerox WorkCentre 5225;inNN;var trItms|(Xerox WorkCentre 5225)|11111/x-admin +Xerox Corporation;XEROX WORKCENTRE;Header Frame;inUriToMatch|(Potential Generic Xerox)|admin/1111;x-admin/11111 +Xerox Workstation M20i;var HEADER_FRAME;var BRANDING_FRAME|(Xerox Workstation M20i)|admin/1111 +ChangeDefWebLanguage();script/cookieCoke.js;script/Common_script.js;NOSCRIPT|(Potential Workcenter 3550)|admin/1111 +WorkCentre 6605DN;frame src="menuhome.htm"|(WorkCentre 6605DN)|No default pass +Xerox WorkCentre 7232;var nvTree;var rSec|(Xerox WorkCentre 7232)|11111/x-admin +Xerox WorkCentre 5325;var nvTree;var csItms|(Xerox WorkCentre 5325)|admin/1111 +Xerox WorkCentre 7345;var nvTree;var csItms|(Xerox WorkCentre 7345)|admin/1111;11111/x-admin +Dell Color Laser 3110cn;frameleft.htm;TopFrame|(Dell Laser 3110cn)|No Default Username;Pass +HP LaserJet Pro MFP M521dn;setupUrls[index++];manageUrls|(HP MFP M521dn)|No default username/pass +HP Color LaserJet CM2320nf MFP;applicationMastheadSmall|(HP Color LaserJet CM2320nf)|No default username/pass +HP LaserJet M1522n MFP;mastheadIcon|(HP LaserJet M1522n)|No default username/pass +HP LaserJet M1536dnf;buttonManager.js;mastheadIcon|(HP LaserJet M1536dnf)|No default username/pass +HP LaserJet M2727nf MFP;mastheadIcon;mastheadTitle|(HP LaserJet M2727nf)|No default username/pass +HP LaserJet 1536dnf MFP;mastheadIcon;mastheadTitle|(HP LaserJet 1536dnf)|No default username/pass +HP Color LaserJet CM4540 MFP;class="device-name"|(HP Color LaserJet CM4540)|No default username/pass (potential username admin, no pass) +Synology DiskStation|Monego;DiskMessageHandler;VideoPlayer|(Synology)|admin/ +Brother MFC-8480DN;Brother Industries;OpenConfirmWindow|(Brother 8480DN)|/access;admin/access +HP LaserJet 700 color MFP M775;/hp/device/ControlPanelCustomization/Index|(HP LaserJet 700)|No default username/pass +MB471;okilogo;replacelogo;savecolor|(OKI MB471)|/aaaaaa;000000;0000;root/(last 6 of mac address Uppercased) +MB461;okilogo;var pagename;var status_ad_flag|(OKI MB461)|/aaaaaa;000000;0000;root/(last 6 of mac address Uppercased) +dlink;document.login_form.f_LOGIN_NAME.value!="admin";document.login_form.f_login_type.value=0;function checkID()|(DNS-323;DNS-343)|admin/ +var re=/root;anonymous;nobody;administrator;ftp;guest;squeezecenter;sshd;messagebus;netdev/i;var cUName = $.cookie('uname');var cPwd = $.cookie('password');/cgi-bin/login_mgr.cgi|(Potential DNS-320L NAS)|admin/;admin/ +APC;Log On;function isValidBrowser();APC Website;var nAgt|(Potential APC SmartUPS)|apc/apc +;var RVL_str = "NULL";var RVL_decode_flg = "0";frameset rows="*";src="/configuration/cover_frame" scrolling="no"|(Potential IPmux-216)|su/1234;user/1234;tech/1234 +Avaya Aura; System manager 6.1;div class="legalNoticeDiv";div class="loginouterdiv"|(Avaya Aura System Manager 6.1)|admin/admin123 +hp LaserJet 1320 series;var ieVSupported = "MSIE 5.0";hp/device/banner.html|(HP LaserJet 1320 series)|/ (no default username/password) +hp LaserJet 4250;a.hpButtonNavigationLink;div.hpConsumableBlockData|(HP LaserJet 4250)|/ (no default username/password) +hp color LaserJet 4600;images/hp_invent_logo.gif;jsfiles/formatting.css|(HP LaserJet 4600)|/ (no default username/password) +HP Color LaserJet CP2025;td class="mastheadIcon";applicationMastheadSmall|(HP LaserJet CP2025)|/ (no default username/password) +Rainwise IP-100;Relative Humidity;Solar Rad;Leaf Wetness;var exdate=new Date()|(Rainwise IP-100)|admin/admin,admin/paradox,;paradox/paradox +WebDVR;var ip;var pwd;login.sitecode.value;DX8100|(DX8100 Web DVR)|admin/admin +DYMO LabelWriter Print Server;InternetExplorer3.0(or later)|(DYMO LabelWriter Print Server)|admin/admin +HP System Management Homepage Login;Check if the user is already connected;pageColumns|(HP System Management)|username and pass of OS;domain account +Polycom RMX 1000;ondragstart;cfg_ui_hide;proxy_log_ip|(Polycom RMX 1000)|POLYCOM/POLYCOM +Sign In|Hyperic;body class="tundra";since dojo has trouble when;screencastLink|(Hyperic)|hqadmin/hqadmin +HP System Management Homepage;HP-UX removed;Unable to create a socket to communicate|(HP System Management)|username and pass of OS;domain account On Board Remote Management;This site requires the use of a frames capable;Web browser|guest/guest -QUANTUM - Scalar i40 Login Screen;var bLoggingin = false;enterKey(event)|(Scalar i40 Login) admin/password -Management Console - Login;AVANCE CSS;Stratus Technologies Bermuda|admin/admin -Login;Sun GlassFish Enterprise Server;onmouseover|(Oracle Glassfish Server) admin/ admin/changeit admin/admin -ZeroShell;cgi-bin/kerbynet?Action=Render;StartSession|(Zeroshell Web App) admin/zeroshell -HP System Management Homepage Login;FramesAreThere;inNimbus;imageFromStatus(|(HP System Management) username and pass of OS or domain account -images/loytec.gif;LIP-3ECTB|(Loytec LIP-3ECTB) admin/loytec4u -LenovaEMC px4-300r;Enter administrator username and password;mngpwd|(Iomega px4-300r) root/ADMIN or admin/ADMIN or ADMIN/ADMIN -My Book World Edition;Network Storage Manager;Copy Manager;Downloader|(My Book World Edition) admin/admin -THECUS 1U4500;/usr/usrgetform.html;/pub/css.css|(THECUS 1U4500) admin/admin -HP IP Console Switch G2|(HP IP Console Switch G2) Admin/ -Oracle;PeopleSoft Enterprise Sign-in;function setFocus;pslogincopyright|(Oracle Peoplesoft Enterprise) PS/PS or VP1/VP1 -a id="id_LaCie" target="_blanck" href= "http://www.lacie.com">;LaCie;Dashboard;body class="bodynormaldashboard"|(Lacie 2Big NAS) admin/admin (changed at first login though) -Synology;DiskStation;DS1513;Multitasking,Web Application,Personal Cloud;SynohdpackStatus|(Synology DS1513) admin/ -Synology;DiskStation;DS212J;modules/PersonalSettings/style.css;script type="text/javascript">SYNO.SDS.Session|(Synology DS212J) admin/ -Synology;DiskStation;DS214;modules/BackupReplicationApp/style.css;|(Synology Diskstation DS214) admin/ -Synology;DiskStation;DS413;modules/BackupReplicationApp/style.css;|(Synology Diskstation DS413) admin/ -Synology;DiskStation;DS713;modules/AdminCenter/style.css|(Synology Diskstation DS713) admin/ -hp color LaserJet 5550;div.hpConsumableBlockData;td class="hpBanner"|(HP Color LaserJet 5550) -HP LaserJet P4015;td style="vertical-align;this.LCDispatcher;deviceStatusPage|(HP Color LaserJet P4015) -function initFavoriteDevices(;function javaPluginExists();Dominion;function addDiscoveredDevices|Raritan Dominion KX II admin/raritan -EasyCoder PM4i;navframe;FRAME src;FRAMESET;noresize scrolling| EasyCoder PM4i admin/pass -Symmetricom SyncServer S100;var serverName;function usernameKey;function answerKey;loginPasswordTable;passedit|Symmetricom SyncServer S100 admin/symmetricom -KYOCERA;idxlang;opt_msg1_;startwlm|Kyocera Printer (General) Admin/Admin -Top Page - MX-M465N;class="modelName">MX-M465N;delta_close.gif;name="updatebtn" type="button"|SHARP MX-M456N Printer admin/admin -NetGear GS108T;class="logoNetGear space50Percent topAlign;class="logoNetGear space50Percent topAlign|Netgear GS108T Switch /password -airos_logo.png;form enctype="multipart/form-data" id="loginform" method="post";align="center" class="loginsubtable";function onLangChange()|AirOS ubnt/ubnt -Any time & Any where;IP Surveillance for Your Life;form name="myForm" method="POST" target="_top" onSubmit="return check();function createHttpRequestObj()|DVR (AV760 DVR) admin/admin or admin,/admin -Grandstream Device Configuration;action="dologin" method="post" name="loginForm";All Rights Reserved Grandstream Networks|GrandStream Device Admin User: /admin End User: /123 -DSL-2640U;input type="checkbox" class="remb"> Remember me;id="A2" name="A2" type="password" maxlength="30"|D-Link DSL-2640U admin/admin -a href="http://mikrotik.com">

WebFig Login:

|Mikrotik Router admin/ -loginPassword.value = "ZyXEL ZyWALL Series";P-660RU-T1 v2;function passwordMD5(str);function LoginClick(hiddenPassword, loginPassword)|P-660RU-T1 v2 Ethernet/USB Router /1234 -function hex_md5(s) { return binl2hex(core_md5(str2binl(s), s.length * chrsz));bit_rol(;Welcome to the Web Configurator;OX253P|OX253P Router admin/admin admin/1234 -var kerio = {lib:{};kerio.engine.acceptedLanguages;upper-message-container;action="/server/login" method="post" id="container"|Kerio Control Device admin/ -meta name="SonicWALL Administrator" content;SonicWALL - Authentication;window.onunload=onPageUnload;"auth1.html" name="authFrm"|SonicWall Device admin/password -D-Link VoIP Router;frameset framespacing="0" frameborder="0" rows="0,*"|DVG-5402SP admin/ +QUANTUM|Scalar i40 Login Screen;var bLoggingin = false;enterKey(event)|(Scalar i40 Login)|admin/password +Management Console|Login;AVANCE CSS;Stratus Technologies Bermuda|admin/admin +Login;Sun GlassFish Enterprise Server;onmouseover|(Oracle Glassfish Server)|admin/;admin/changeit;admin/admin +ZeroShell;cgi-bin/kerbynet?Action=Render;StartSession|(Zeroshell Web App)|admin/zeroshell +HP System Management Homepage Login;FramesAreThere;inNimbus;imageFromStatus(|(HP System Management)|username and pass of OS;domain account +images/loytec.gif;LIP-3ECTB|(Loytec LIP-3ECTB)|admin/loytec4u +LenovaEMC px4-300r;Enter administrator username and password;mngpwd|(Iomega px4-300r)|root/ADMIN;admin/ADMIN;ADMIN/ADMIN +My Book World Edition;Network Storage Manager;Copy Manager;Downloader|(My Book World Edition)|admin/admin +THECUS 1U4500;/usr/usrgetform.html;/pub/css.css|(THECUS 1U4500)|admin/admin +HP IP Console Switch G2|(HP IP Console Switch G2)|Admin/ +Oracle;PeopleSoft Enterprise Sign-in;function setFocus;pslogincopyright|(Oracle Peoplesoft Enterprise)|PS/PS;VP1/VP1 +a id="id_LaCie" target="_blanck" href= "http://www.lacie.com">;LaCie;Dashboard;body class="bodynormaldashboard"|(Lacie 2Big NAS)|admin/admin (changed at first login though) +Synology;DiskStation;DS1513;Multitasking,Web Application,Personal Cloud;SynohdpackStatus|(Synology DS1513)|admin/ +Synology;DiskStation;DS212J;modules/PersonalSettings/style.css;script type="text/javascript">SYNO.SDS.Session|(Synology DS212J)|admin/ +Synology;DiskStation;DS214;modules/BackupReplicationApp/style.css;|(Synology Diskstation DS214)|admin/ +Synology;DiskStation;DS413;modules/BackupReplicationApp/style.css;|(Synology Diskstation DS413)|admin/ +Synology;DiskStation;DS713;modules/AdminCenter/style.css|(Synology Diskstation DS713)|admin/ +hp color LaserJet 5550;div.hpConsumableBlockData;td class="hpBanner"|(HP Color LaserJet 5550)| +HP LaserJet P4015;td style="vertical-align;this.LCDispatcher;deviceStatusPage|(HP Color LaserJet P4015)| +function initFavoriteDevices(;function javaPluginExists();Dominion;function addDiscoveredDevices|Raritan Dominion KX II|admin/raritan +EasyCoder PM4i;navframe;FRAME src;FRAMESET;noresize scrolling| EasyCoder PM4i|admin/pass +Symmetricom SyncServer S100;var serverName;function usernameKey;function answerKey;loginPasswordTable;passedit|Symmetricom SyncServer S100|admin/symmetricom +KYOCERA;idxlang;opt_msg1_;startwlm|Kyocera Printer (General)|Admin/Admin +Top Page|MX-M465N;class="modelName">MX-M465N;delta_close.gif;name="updatebtn" type="button"|SHARP MX-M456N Printer|admin/admin +NetGear GS108T;class="logoNetGear space50Percent topAlign;class="logoNetGear space50Percent topAlign|Netgear GS108T Switch|/password +airos_logo.png;form enctype="multipart/form-data" id="loginform" method="post";align="center" class="loginsubtable";function onLangChange()|AirOS|ubnt/ubnt +Any time & Any where;IP Surveillance for Your Life;form name="myForm" method="POST" target="_top" onSubmit="return check();function createHttpRequestObj()|DVR (AV760 DVR)|admin/admin;admin,/admin +Grandstream Device Configuration;action="dologin" method="post" name="loginForm";All Rights Reserved Grandstream Networks|GrandStream Device|/admin (admin);/123 (user) +DSL-2640U;input type="checkbox" class="remb"> Remember me;id="A2" name="A2" type="password" maxlength="30"|D-Link DSL-2640U|admin/admin +a href="http://mikrotik.com">

WebFig Login:

|Mikrotik Router|admin/ +loginPassword.value = "ZyXEL ZyWALL Series";P-660RU-T1 v2;function passwordMD5(str);function LoginClick(hiddenPassword, loginPassword)|P-660RU-T1 v2 Ethernet/USB Router|/1234 +function hex_md5(s)|{ return binl2hex(core_md5(str2binl(s), s.length * chrsz));bit_rol(;Welcome to the Web Configurator;OX253P|OX253P Router|admin/admin;admin/1234 +var kerio = {lib:{};kerio.engine.acceptedLanguages;upper-message-container;action="/server/login" method="post" id="container"|Kerio Control Device|admin/ +meta name="SonicWALL Administrator" content;SonicWALL|Authentication;window.onunload=onPageUnload;"auth1.html" name="authFrm"|SonicWall Device|admin/password +D-Link VoIP Router;frameset framespacing="0" frameborder="0" rows="0,*"|DVG-5402SP|admin/ mikrotik routeros > administration;form name="loginForm" action="/cfg" method="post" onsubmit="doLogin();mikrotik routeros;configuration page|Mikrotik Routeros admin/ -Grandstream Device Configuration;form action="/cgi-bin/dologin" method="post" name="loginForm";All Rights Reserved Grandstream Networks;input name="P2" type=password size=30 maxlength=30|Grandstream Networks: /admin or /123 -HP Color LaserJet CP3505;input name="btnContinue" type="image";img class="hpPageImage" src="images/question.gif" alt="On-line help|HP Color Jet CP3505 Printer -ATEN International Co Ltd;body onload='PageInit();form name="form1" action="/cgi/login.cgi" method="post";img src="../images/logo.gif" style="margin;alert(lang.LANG_LOGIN_INVALID_USERNAME);document.getElementById("login_word")|Possible SuperMicro IPMI ADMIN/ADMIN (Creds need confirming) -Welcome to the Web-Based Configurator;function str2blks_MD5(str);loginPassword.value = "ZyXEL ZyWALL Series";Prestige_Login" value="Login"|Zyxel P-660HW-T1 /1234 -AxisTV|AxisTV Login administrator/tech -