Testing for weak credentials and default accounts
When reading this section’s title, as an attentive reader, you probably drew a parallel with several routers, access points, network bridges, and an infinite number of Internet of Things (IoT) devices that are out there. Unfortunately, depending on the customer’s needs, they are just briefly configured and put to work, almost as a “plug-and-play” box. As a matter of fact, some are designed to be installed in exactly this way. The problem is that some of those types of equipment are somehow meant to be intelligent, which would require more complex software running and the requirement for credentials. As many users/customers simply don’t care about how the product works, a complete universe of possibilities opens up to explore default credentials.
The same can happen with APIs. Sometimes, the developer forgets to delete a credential pair used just for testing, sometimes it’s hardcoded somewhere...
