ihebski/DefaultCreds-cheat-sheet: Default Credentials Database for Security Testing
One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password.
Introduction
Default credentials remain one of the most persistent and exploitable weaknesses in enterprise infrastructure. Despite decades of security awareness, devices ship with predictable username-password combinations—admin/admin, root/root, blank fields—that attackers routinely exploit during initial access. For penetration testers and blue teamers alike, discovering these credentials quickly and accurately is essential, yet fragmented across dozens of wordlists, proprietary tools, and outdated references.
DefaultCreds-cheat-sheet addresses this friction directly. Maintained by ihebski, this open-source Python↗ Bright Coding Blog tool consolidates thousands of default credentials into a single, searchable database accessible from the command line. With 6,666 GitHub stars, 781 forks, and an active maintenance record (last commit July 9, 2026), it has become a practical fixture in security tooling workflows. This article examines what DefaultCreds-cheat-sheet offers, how to deploy it, and where it fits alongside complementary tools—grounded entirely in its documented capabilities.
What is ihebski/DefaultCreds-cheat-sheet?
DefaultCreds-cheat-sheet is a Python-based CLI utility and curated dataset that aggregates default login credentials for hardware devices, software applications, and network infrastructure. The project serves dual audiences: offensive security practitioners (pentesters, red teamers) who need rapid credential discovery during engagements, and defensive teams (blue teamers, asset owners) who must identify and remediate default-password exposures before attackers do.
The dataset contains 3,711 credential records spanning 1,398 unique products/vendors, 1,121 unique usernames, and 1,680 unique passwords. The most frequently represented vendor is Oracle (235 entries), while blank usernames and passwords are the most common single values—reflecting real-world factory defaults where authentication fields are left empty.
The tool is distributed under the MIT License and published to PyPI as defaultcreds-cheat-sheet, enabling standard Python package management installation. Its primary language is Python, and it has been tested on Linux (Kali, Ubuntu, Lubuntu), Windows 10/11, and macOS.
The project's relevance stems from its practical consolidation of sources that would otherwise require manual cross-referencing: the Changeme project, RouterSploit, betterdefaultpasslist, SecLists, ics-default-passwords, and vendor documentation. Rather than maintaining disparate wordlists, security teams gain a unified, updateable interface.
Key Features
Searchable Command-Line Interface
The core creds script enables fuzzy product search from the terminal. Users type creds search <product> and receive formatted tables of matching vendor-product-username-password combinations. This eliminates manual grep operations across multiple wordlist files.
Export for Brute-Force Workflows
Search results can be exported to separate username and password files (/tmp/<product>-usernames.txt and /tmp/<product>-passwords.txt). These flat files integrate directly with brute-force tools like Hydra, Medusa, or custom scripts—no reformatting required.
Self-Updating Database
The creds update command checks for dataset updates and downloads refreshed records. This addresses credential database staleness, a common problem with static wordlist repositories that grow outdated as new devices ship with new defaults.
Proxy Support
From version 0.5.2 onward, all operations support HTTP/HTTPS proxy configuration via --proxy. This enables use in corporate environments, through Burp Suite for traffic inspection, or via anonymization layers during sensitive engagements.
Cross-Platform Compatibility
Explicit testing on Linux distributions (including Kali Linux for pentesting workflows), Windows 10/11, and macOS ensures predictable behavior across analyst workstations regardless of operating system preference.
Complementary Ecosystem Integration
The project acknowledges and links to Pass Station, a separate CLI/library by noraj that consumes the same DefaultCreds-Cheat-Sheet.csv dataset with advanced search features (regular expressions, field-specific queries, JSON/YAML/CSV output). This demonstrates healthy ecosystem interoperability rather than competitive isolation.
Use Cases
Penetration Testing: Rapid Credential Enumeration
During external or internal network assessments, pentesters encountering unknown web interfaces, SSH services, or management consoles need immediate credential candidates. DefaultCreds-cheat-sheet provides contextual defaults per product rather than generic top-1000 password lists, increasing success rates against specific target technologies.
Red Teaming: Operational Speed
Red team operators under time constraints benefit from single-command lookup during lateral movement. Identifying that a network appliance runs a specific firmware version—and having its documented default credentials instantly available—can compress hours of manual research into seconds.
Blue Teaming: Proactive Default-Password Discovery
Defensive teams use the tool to audit their own infrastructure against the dataset. The OWASP Web Security Testing Guide (WSTG-ATHN-02) explicitly recommends testing for default credentials; this tool operationalizes that guidance with a comprehensive, maintained reference.
Vulnerability Assessment Automation
Security engineers building continuous compliance scanning can integrate creds search and creds update into scripts that periodically check newly discovered assets against the latest default credential database, flagging exposures for remediation ticketing.
ICS/OT Security Assessments
The inclusion of ics-default-passwords as a source extends utility to industrial control systems, where default credentials in SCADA, HMI, and PLC equipment represent critical infrastructure risk. This specialization distinguishes the dataset from general-purpose password lists.
Installation & Setup
PyPI Installation (Recommended)
The simplest installation uses Python's package manager:
# Install from PyPI
$ pip3 install defaultcreds-cheat-sheet
# Verify installation by searching for Tomcat credentials
$ creds search tomcat
This method handles dependencies automatically and places the creds executable on your PATH.
Manual Installation from Source
For development, customization, or environments without PyPI access:
# Clone the repository
$ git clone https://github.com/ihebski/DefaultCreds-cheat-sheet
# Navigate to project directory and install Python dependencies
$ pip3 install -r requirements.txt
# Install system-wide executable (Linux/macOS)
$ cp creds /usr/bin/ && chmod +x /usr/bin/creds
# Verify functionality
$ creds search tomcat
The cp creds /usr/bin/ step creates a global command; adjust path (/usr/local/bin/, ~/.local/bin/) based on your system's conventions and permissions.
Platform Notes
| Operating System | Tested |
|---|---|
| Linux (Kali, Ubuntu, Lubuntu) | ✔️ |
| Windows (10, 11) | ✔️ |
| macOS | ✔️ |
Windows users may need to add Python Scripts directory to PATH manually, or use python -m creds invocation depending on installation configuration.
Real Code Examples
Example 1: Basic Product Search
# Search for Apache Tomcat default credentials
➤ creds search tomcat
+----------------------------------+------------+------------+
| Product | username | password |
+----------------------------------+------------+------------+
| apache tomcat (web) | tomcat | tomcat |
| apache tomcat (web) | admin | admin |
...
+----------------------------------+------------+------------+
Explanation: The search subcommand performs substring matching against product names. Results display in a formatted table with three columns: product identifier, username, and password. The output above shows two common Tomcat defaults—tomcat/tomcat and admin/admin—with additional matches truncated. This immediate visibility helps testers prioritize credential attempts based on product specificity.
Example 2: Database Update
# Check for and download credential database updates
➤ creds update
Check for new updates...🔍
New updates are available 🚧
[+] Download database...
Explanation: The update subcommand queries the remote source for dataset changes. When updates exist, it downloads and replaces the local database automatically. This is critical for maintaining accuracy: new devices enter the market continuously, and community contributions expand coverage. Running creds update before engagements ensures access to the latest entries.
Example 3: Export for Brute-Force Tools
# Search and export username/password lists to /tmp
➤ creds search tomcat export
+----------------------------------+------------+------------+
| Product | username | password |
+----------------------------------+------------+------------+
| apache tomcat (web) | tomcat | tomcat |
| apache tomcat (web) | admin | admin |
...
+----------------------------------+------------+------------+
[+] Creds saved to /tmp/tomcat-usernames.txt , /tmp/tomcat-passwords.txt 📥
Explanation: Appending export to any search command generates two flat files: one containing all unique usernames, the other all unique passwords. These files feed directly into brute-force tools. For Tomcat specifically, /tmp/tomcat-usernames.txt would contain tomcat and admin, while /tmp/tomcat-passwords.txt would contain tomcat and admin—ready for hydra -L /tmp/tomcat-usernames.txt -P /tmp/tomcat-passwords.txt or equivalent.
Example 4: Proxy-Authenticated Operations
# Route search through local proxy (e.g., Burp Suite, corporate gateway)
➤ creds search tomcat --proxy=http://localhost:8080
# Update database through proxy
➤ creds update --proxy=http://localhost:8080
# Combined export through proxy
➤ creds search tomcat --proxy=http://localhost:8080 export
Explanation: The --proxy flag (available from version 0.5.2) routes all HTTP traffic through the specified proxy. This supports: (1) traffic inspection in Burp Suite to verify update integrity, (2) corporate environments with mandatory outbound proxies, and (3) operational security through anonymization layers. The flag applies consistently across search, update, and export operations.
Advanced Usage & Best Practices
Integration with Reconnaissance Pipelines
Combine DefaultCreds-cheat-sheet with service detection tools like Nmap or Masscan. After identifying a Tomcat instance on port 8080, pipe the product name directly into creds search rather than manually consulting separate references. For automation:
# Hypothetical pipeline (user-constructed, not from README)
# nmap -sV target | grep -i "apache tomcat" | awk '{print $NF}' | xargs creds search
[INTERNAL_LINK: building-reconnaissance-automation-pipelines]
Dataset Hygiene
Run creds update before each engagement or weekly during continuous monitoring. The dataset grows through community contributions; stale local copies miss recently added devices. The update mechanism is lightweight—no package reinstallation required.
Proxy Verification
When using --proxy, verify connectivity with creds update --proxy=<url> first. Update operations confirm end-to-end proxy functionality; if this succeeds, searches will too. This avoids mid-engagement discovery of proxy misconfiguration.
Complementary Tool Selection
For advanced search syntax (regex, field-specific queries, structured output), evaluate Pass Station by noraj. It consumes the same underlying CSV but offers richer query capabilities. DefaultCreds-cheat-sheet excels at quick terminal lookup; Pass Station suits integration into larger analysis workflows.
Scope Awareness
The tool's educational disclaimer—"For educational purposes only, use it at your own responsibility"—reflects legal and ethical boundaries. Deploy only on systems you own or have explicit authorization to test. Default credential testing without permission constitutes unauthorized access in most jurisdictions.
Comparison with Alternatives
| Tool | Primary Function | Key Difference | Trade-off |
|---|---|---|---|
| DefaultCreds-cheat-sheet | Searchable default credential database with CLI | Product-specific search + export for brute-force | Smaller dataset than general wordlists; focused scope |
| Changeme | Automated default credential scanner | Actively tests credentials against services; fully automated | Requires network access to targets; heavier resource use |
| RouterSploit | Router exploitation framework | Integrated exploits beyond credential testing | Steeper learning curve; broader attack surface |
| SecLists | Comprehensive security testing wordlists | Massive general-purpose collections (passwords, payloads, discovery) | No product-specific structure; manual searching required |
Analysis: DefaultCreds-cheat-sheet occupies a middle ground—more structured than raw wordlists, lighter than active scanners. It complements rather than replaces Changeme (which automates testing) and RouterSploit (which delivers exploits). Teams often use DefaultCreds-cheat-sheet for rapid manual lookup during analysis, then feed exported credentials into Changeme for automated validation, or into custom scripts for targeted brute-force.
FAQ
Q: What license covers DefaultCreds-cheat-sheet? MIT License—permissive for commercial and personal use with attribution.
Q: How current is the credential database?
Last repository commit: July 9, 2026. Run creds update to fetch latest community contributions.
Q: Can I use this on Windows?
Yes—explicitly tested on Windows 10 and 11. Use pip3 install or manual installation.
Q: Does it test credentials automatically? No. It provides credential candidates; use separate tools (Hydra, Medusa, Changeme) for active testing.
Q: How do I contribute new credentials? Submit a pull request to the GitHub repository with additions to the dataset.
Q: Is proxy support mandatory?
No—optional from version 0.5.2. Use --proxy only when required by your environment.
Q: What Python version is required?
The README specifies pip3 and python3 conventions; ensure Python 3.x is installed.
Conclusion
ihebski/DefaultCreds-cheat-sheet delivers focused, practical value for security professionals who need rapid access to default credential intelligence. Its 3,711-record dataset, maintained across 1,398 products, strikes a balance between comprehensiveness and searchability that raw wordlists cannot match. The Python CLI integrates cleanly into existing workflows—whether manual pentesting, automated compliance scanning, or defensive asset auditing—while proxy support and cross-platform compatibility address real operational constraints.
The tool is best suited for: penetration testers needing contextual defaults per technology, blue teamers conducting proactive exposure discovery, and security engineers building credential-aware automation. It complements rather than replaces active scanners like Changeme and general wordlist repositories like SecLists.
With 6,666 GitHub stars reflecting community validation and active maintenance through 2026, DefaultCreds-cheat-sheet merits evaluation in any security tooling stack. Install via pip3 install defaultcreds-cheat-sheet or clone from source, run creds update, and begin searching.
Explore the repository: https://github.com/ihebski/DefaultCreds-cheat-sheet
