The Top 10 Not So Common SSH Usernames and Passwords
Our list of "Top" ssh usernames and password is pretty static. Well known defaults, like "root" and "admin" are at the top of the list. But there are always some usernames and password in the list that are not as well known, or only showed up more recently. I will focus in this diary on these "second tier" credentials.
345gs5662d34
Used by Polycom CX600 IP phones, this password often shows up in the username field (as other passwords do) if sloppy bots do enter it into the wrong field.
zyfwp
A backdoor account in Zyxel equipment. It was found by Rapid 7 (and later removed by Zyxel) in 2020.
yhtcAdmin
Used in "Youhua PT939G" fiber routers.
vadmin
The default username for the web hosting platform LiteSpeed. Can be used via SSH or HTTP.
telecomadmin
The username used by Huawei ONT HG8245H5 fiber termination kit.
chenzilong
Not sure. But it may be a popular Chinese character. Maybe anybody reading this knows?
7ujMko0admin
Some Dahua network NVRs use this telnet/ssh password. They are pretending the string "7ujMko0" to the web password, which by default is "admin".
a1sev5y7c39k
The default password for some unspecified routers using the Realtek chipset.
Xpon@Olt9417#
V*SOL GPON OLT default password
ve0RbANG
used with the "YhtcAdmin" username for Youhua PT939G optical network termination equipment. The same device also uses Admin/1234 and Admin/Telecom_1234. .
You can look at our top password list here:
https://isc.sans.edu/data/ssh.html
I will add some of the details about our username and password pages as you look up a particular password. For example:
https://isc.sans.edu/ssh_usernames.html?username=345gs5662d34
---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
Application Security: Securing Web Apps, APIs, and Microservices | Online | US Eastern | Jan 27th - Feb 1st 2025 |
Comments
I'm currently using https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10-million-password-list-top-1000.txt
That list was last updated 6 years ago. I know there isn't much movement in the top most common passwords, but my control states I'm supposed to update my list.
Egamma
Oct 17th 2024
1 month ago