Weak Passwords

What it is

Weak passwords and default credentials represent one of the most prevalent authentication vulnerabilities. Applications, devices, and services often ship with default credentials or accept trivially guessable passwords. Attackers use credential stuffing, password spraying, and brute-force attacks to compromise accounts using these common passwords.

Attack Vectors

• Admin panels (WordPress, Joomla, phpMyAdmin)
• Network devices (routers, switches, IoT)
• Database services (MySQL, MongoDB)
• Default application accounts
• Accounts where users choose weak passwords

Testing Methodology

1. Test common default credentials for identified platforms
2. Attempt password spraying with top-100 common passwords
3. Check admin panel URLs (/admin, /wp-admin, /administrator)
4. Test for password policy enforcement with weak inputs

Indicators of Vulnerability

• Successful login with default or common credentials
• Absence of account lockout after repeated failed attempts
• No minimum password length or complexity enforcement

Detection Guidance

Use breach database APIs to check if submitted passwords are in known breach lists. Implement password strength meters. Alert on logins with common credential patterns.

Mitigation & Remediation

• Enforce minimum password length (12+ characters)
• Check new passwords against known breached password databases
• Implement account lockout or exponential backoff after failed attempts
• Force password change on first login for default-credential accounts
• Require MFA for all accounts

References

• OWASP Password Storage Cheat Sheet
• NIST SP 800-63B — Digital Identity Guidelines
• OWASP Hunting — Weak Passwords (upstream)