ScopeHunter · Tools

Default credential scanner

Check a domain you can prove you own for known default and compromised credential combinations — the ones attackers try first.

What it does

Shipped appliances, admin panels, and forgotten services often keep their factory logins — admin/admin, vendor defaults, credentials already exposed in public breaches. The scanner checks a domain against a small, curated set of those known combinations so you find them before someone else does.

Built so it can't be abused

Prove you own the domain. You verify control with a DNS TXT record before any test runs — you can only scan domains you actually hold.
Authorization is explicit. Verification attests you're authorized to security-test the target, not merely that you control its DNS.
Testing is conservative. A small curated credential set, and a scan stops on first success rather than hammering the service.
Results are private. Findings are yours; the domain itself is stored encrypted, and ownership is re-verified over time since domains change hands.

This is an authorized-testing tool for domains you own or are cleared to test — not a way to probe third parties. Unauthorized credential testing is out of scope and against the acceptable-use policy.

Where it fits

Why default credentials, specifically

Because they are the attack that needs no exploit. Routers, cameras, NAS boxes, admin panels, and forgotten services ship with documented username/password pairs, and internet-wide scanners try them continuously — the Mirai botnet was built from sixty-odd factory logins, and default credentials remain a top initial-access vector in incident reports year after year. A vulnerability needs a CVE, a working exploit, and an unpatched target; a default credential needs a login form.

It is also a compliance finding in every framework this platform speaks: CMMC 3.5.2 and PCI DSS 2.2.2 both require vendor defaults changed or disabled, and an assessor can test it exactly the way this scanner does.

How the scan works — and its boundaries

You prove ownership of the domain by DNS record before anything runs — the scanner refuses targets you cannot demonstrate are yours, because testing credentials against someone else''s systems is unauthorized access, full stop. Against your verified domain it tries known default and breach-compromised combinations against exposed services, rate-limited, and reports privately to you: which service, which credential class, and what to change.

What it is not: a penetration test, a vulnerability scan, or a PCI ASV scan. It answers one narrow question — "do any of my exposed services accept a factory or breached credential?" — thoroughly and with authorization, and leaves the rest of the assessment to the rest of your program.

The scanner is one of ScopeHunter's practitioner tools, alongside a live CISA KEV / NVD / HIBP security bulletin feed and the compliance workspace for CMMC 2.0, SOC 2, and ISO 27001. Default-credential exposure maps directly to access-control and authentication requirements in each of those frameworks.

ScopeHunter is built and operated by L-IT Technical Solutions, a Texas IT consultancy — the same people who run the CMMC automation described here against their own production infrastructure.