A DB of known Web Application Admin URLS, Username/Password Combos and Exploits
This list was originally released @ DerbyCon 2012 by Gillis Jones
Updated and released by the Web App Defaults DB Group
If you have info and don't want to trouble with Git, please feel free to shoot the info to:
webappdefaultsdb_submissions@room362.com
and let us worry about the repo voodoo.
If you wish to submit via git, please use the following field types:
- ADMINURL:
- USERPASS:
- INTERESTINGURL:
- EXPLOITLINK:
- COMMENT:
This will make it much easier for people to parse the entire db for information.
For example:
## Example CMS
Info: This webapp falls over if you hit /dos.php on version 1.0 and prior
* ADMINURL: /admin/uberleet.php
* USERPASS: root:toor
* INTERESTINGURL: /database_test.php
* EXPLOITLINK: [http://exploitsdownload.com/search/cms](http://exploitsdownload.com/search/cms)
* COMMENT: Usernames with be user@domain.com
Documentation: [http://www.wikipedia.org/](http:/www.wikipedia.org/)
API Documentation: [https://apigee.com/console](https://apigee.com/console)
- Accrisoft Freedom
- AdaptCMS Lite
- Adobe Business Catalyst
- Adobe CQ5
- Alfresco Community Edition
- Apache Lenya
- ATutor
- Autonomy Interwoven Teamsite CMS
- b2evolution
- BEdita
- BLOG:CMS
- blosxom
- Bricolage
| Cascade Server | /login.act | http://help.hannonhill.com/kb/security | ||||
| CivicSpace | To be determined | |||||
| Clickability (Limelight Networks) | hosted by limelight? | |||||
| CMS Made Simple | admin | http://exploitsdownload.com/search/cmsmadesimple | ||||
| CMSimple | admin | test | http://exploitsdownload.com/search/cmsimple | |||
| Composite C1 | /Administration | admin@.com | admin | Username may be admin@yourstore.com | ||
| Computhink ViewWise | ||||||
| Concrete5 | /index.php/login (alternatively /dashboard) | admin | random set at install | "Yep, great tip. When you go to logs (after resetting the password), you tick the box for emails sent and click on print view with full text. This opens the email that was sent with the link to set a new password. Click on that link and it will open a new browser window." | http://exploitsdownload.com/search/concrete5 | |
| Contegro | Hosted on Contegro. | |||||
| Content SORT | WP plugin | |||||
| CoreMedia WCM | <- Magic Quadrant Masterbaters | |||||
| Cotonti | /admin.php | http://exploitsdownload.com/search/cotonti | ||||
| Daisy | /login | admin | admin | |||
| Django-cms | /admin | admin | http://exploitsdownload.com/search/django | |||
| Dokuwiki | /dokuwiki?do=login | http://exploitsdownload.com/search/dokuwiki | ||||
| Dotclear | /dotclear/admin/ | http://exploitsdownload.com/search/dotclear | ||||
| dotCMS | /admin/ | admin@dotcms.org (pre 1.9.2 test@dotcms.org) | admin (pre 1.9.2 test) | http://dotcms.com/docs/1.9/DefaultsOnAnInitialDotCMSInstall | http://exploitsdownload.com/search/dotcms | |
| DotNetNuke | Admin login | admin | http://exploitsdownload.com/search/dotnetnuke | |||
| Drupal | /admin or /?q=admin (non-clean) | admin | assigned in setup | http://exploitsdownload.com/search/drupal | ||
| DSpace | (dspace?).site.com/admin | |||||
| DynPG | /cms or /dynpg | http://exploitsdownload.com/search/dynpg | ||||
| e107 | //e107_admin/admin.php?view.all | http://exploitsdownload.com/search/e107 | ||||
| Ektron CMS400.Net | /workarea/login.aspx | admin | admin | documentation.ektron.com/CMS400/v70/adminmanual.pdf | ||
| Elcom CMS | http://exploitsdownload.com/search/elcom | |||||
| EMC Documentum ECM | ||||||
| EPrints | /perl/users/home | admin | admin | |||
| Escenic Content Engine | /escenic/ | _admin | Specified by owner | documentation.vizrt.com/ece-pub-admin-guide-5.4.pdf | ||
| Exponent CMS | http://docs.exponentcms.org/docs/2.0.3/logging-in | http://exploitsdownload.com/search/exponentcms | ||||
| ExpressionEngine | /admin.php or /phpmyadmin/ | http://exploitsdownload.com/search?q=expression+engine | ||||
| Exsite Webware | /cgi-bin/ | admin | password | |||
| eZ Publish | add "_admin" to the end of the frontoffice url | admin | password | http://exploitsdownload.com/search?q=frog+cms | ||
| Fedora | .com:8091 or /login | admin | admin | |||
| Flagship Docs | ||||||
| Foswiki | ||||||
| Frog CMS | /admin/ | admin | password | creds valid pre 1.0 version | ||
| Geeklog | /admin/ | Admin | password | valid as of 02, looking for more recent sources. | ||
| Habari | /admin/login.php | http://exploitsdownload.com/search?q=habari | ||||
| Hippo CMS | .com:8080/cms | admin | admin | |||
| Hyland OnBase ECM | Info Behind Paywall | |||||
| IBM Enterprise Content Management | ||||||
| IBM Lotus Web Content Management | ||||||
| Ikiwiki | ||||||
| ImpressCMS | /admin.php | |||||
| Jadu | "/mymicrosite/jadu/ | |||||
| " | ||||||
| JCore | /admin/ | admin | ||||
| Joomla! | /administrator or /joomla/administrator | admin | ||||
| Jumbo | jumbo/loginpage.php | admin | password | |||
| Kajona | ||||||
| Kentico CMS | /CMSSiteManager | administrator | :blank: | |||
| KnowledgeTree Community Edition | /knowledgetree/ | admin | admin | |||
| Liferay Community Edition | ||||||
| LogicalDOC | /logicaldoc/webdav/store | admin | admin | As of 4.5 | ||
| Lyceum | ||||||
| Magnolia | :8080/magnoliaAuthor/.magnolia. | superuser | superuser | |||
| Mambo | administrator/index.php | admin | admin | |||
| Mediawiki | ||||||
| MiaCMS | /login.php | admin | let_me_in | |||
| Microsoft Office 365 | ||||||
| Microsoft SharePoint Foundation | ||||||
| Microsoft SharePoint Server | ||||||
| Midgard CMS | /midgard | admin | password | http://www.midgard-project.org/documentation/midgard-admin-sitewizard/#36700c60b73acecb128e78b284b2d84e | ||
| MODx | -Weirdness | |||||
| mojoPortal | /Secure/Login.aspx | admin@admin.com | admin | http://www.mojoportal.com/installation-quick-start.aspx | ||
| Movable Type | _mt/mt.cgi | |||||
| Mura CMS | /admin | admin | admin | http://docs.getmura.com/user-guide/users/ | ||
| Nucleus CMS | /nucleus/ | http://faq.nucleuscms.org/item/80 | ||||
| Nuxeo EP | /admin | Administrator | Administrator | http://doc.nuxeo.com/display/NXDOC54/Setup | ||
| O3spaces | ||||||
| Ocportal | /adminzone | admin | http://ocportal.com/docs5/tut_configuration.htm | http://exploitsdownload.com/search/ocportal | ||
| OpenACS | ||||||
| OpenCms | 8080/opencms/opencms/system/login/ | Admin | admin | http://www.opencms.org/en/development/installation/server.html | http://exploitsdownload.com/search/opencms | |
| OpenKM | /OpenKM | okmAdmin | admin | http://forum.openkm.com/viewtopic.php?f=4&t=3711 | ||
| OpenText ECM Suite | ||||||
| OpenText Web Experience Management | ||||||
| OpenText Web Site Management | ||||||
| OpenWGA | /admin | admin | wga | http://www.openwga.com/home/support/tutorials/going_live_from_openwga_developer_studio.en.html | ||
| Opus | http://exploitsdownload.com/search/opus | |||||
| Oracle ECM Suite | .com:7001/console | http://docs.oracle.com/cd/E17904_01/doc.1111/e14495/verify.htm#CHDHCEFB | creds set in setup | |||
| Orchard Project | /Admin/ | creds set in setup | ||||
| papaya CMS | /papaya/ | http://www.papaya-cms.com | documentation in german | |||
| Peardrop(CMS) | /admin.php | admin(?) | admin | http://peardrop.coolmediatech.com/index.php/Documentation_%280.1.x%29 | ||
| Percussion Software CM1 | ||||||
| Phire CMS | ||||||
| PHP-Fusion | /login.php | http://www.php-fusion.co.uk/ | http://exploitsdownload.com/search/phpfusion/ | |||
| PHP-Nuke | /nuke/admin.php | God | Password | http://exploitsdownload.com/search/phpnuke/ | ||
| PHPSlash | god | password | http://phpxref.com/xref/phpslash/doc/html/single/phpslash.html.source.html | http://exploitsdownload.com/search/phpslash/ | ||
| Phpweblog | /admin/users.php | Bypass using securiteam link | http://www.securiteam.com/unixfocus/6K0021P0KE.html | sitekey:phpweblog | http://exploitsdownload.com/search/phpweblog/ | |
| phpWebSite | /admin.php | admin | phpwebsite | hintsforums.macworld.com/archive/index.php/t-10721.html | http://exploitsdownload.com/search/phpwebsite | |
| phpWiki | /phpwiki/admin.php | |||||
| Pier | .com/?command=PULogin | admin | pier | http://www.piercms.com/doc/faq#193819363 | ||
| pimcore | /admin | admin | admin | www.pimcore.com | http://exploitsdownload.com/search/pimcore/ | |
| PivotX | /pivotx | http://book.pivotx.net | user created name/pass | http://exploitsdownload.com/search/pivotx/ | ||
| Pixie (CMS) | /admin | admin | pixie123 | http://www.getpixie.co.uk/support/article/manual-installation/ | ||
| PmWiki | admin | http://yate.null.ro/pmwiki/index.php?n=PmWiki.PasswordsAdmin | http://exploitsdownload.com/search/pmwiki/ | |||
| Polopoly Web CMS | ||||||
| Prestashop | /admin or /admin939 | http://doc.prestashop.com/display/PS14/System+Administrator+Guide | /admin is renamed upon install | http://exploitsdownload.com/search/prestashop/ | ||
| ProcessWire | /processwire/ | admin | processwire2 | http://www.processwire.com | ||
| Pulse CMS | /pulsepro/ | demo | http://www.pulsecms.com/docs/settings.php | Couldn't find username | http://exploitsdownload.com/search/pulsecms/ | |
| Radiant | /admin/ | admin | radiant | http://radiantcms.org | ||
| RavenNuke CMS | /admin.php or /ravennuke230/admin.php | http://rnwiki.ravennuke.com | http://exploitsdownload.com/search/ravennuke/ | |||
| Refinery CMS | :3000/refinery | http://refinerycms.com/guides/getting-started | No default user | http://exploitsdownload.com/search/refinery/ | ||
| RenovatioCMS | /?RVGET_document=System+Management | www.renovatiocms.com/ | English Site Incomplete | |||
| Scoop | ||||||
| Serendipity | /serendipity/serendipity_admin.php | John Doe | john | http://www.s9y.org/36.html | http://exploitsdownload.com/search/serendipity | |
| SilverStripe | /admin | admin | password | http://doc.silverstripe.org/sapphire/en/topics/configuration | User can assign defaults in configuration | http://exploitsdownload.com/search/silverstripe |
| Sitecore Professional Edition | http://exploitsdownload.com/search/sitecore | |||||
| Sitefinity CMS | /Sitefinity/LoginPages/LoginForm | admin | Password | http://www.sitefinity.com/devnet/kb.aspx | If you see telerik.rad it's sitefinity | http://exploitsdownload.com/search/sitefinity |
| Sitekit CMS | /admin | http://www.sitekit.net | ||||
| SMW+ | root | m8nix | http://www.smwplus.com/index.php/Help:SMW%2B | http://exploitsdownload.com/search/smwplus | ||
| SPIP | ||||||
| Squiz CMS | /_edit | admin/editor/approver | password | http://cms.squizsuite.net/quick-start-guide/ | admin password should be changed | http://exploitsdownload.com/search?q=squiz |
| Squiz Matrix | /_admin | root | root | http://matrix.squizsuite.net/quick-start-guide/ | http://exploitsdownload.com/search?q=squiz | |
| TangoCMS | index.php?url=session or /session | http://tangocms.org/announcements?page=2 | ||||
| Telligent Community | /telligent_evolution | admin | pa$$word | check for /solr/admin | ||
| Textpattern | /textpattern/index.php or /textpattern/ | http://exploitsdownload.com/search?q=textpattern | ||||
| Tiki Wiki CMS Groupware | /tiki/tiki-login_scr.php | admin | admin | http://doc.tiki.org/Admin+Problems | http://exploitsdownload.com/search?q=tikiwiki | |
| Titan CMS | ||||||
| Tribiq CMS | /admin | tribiq.com/tribiq-6-documentation-installation.download | http://exploitsdownload.com/search?q=tribiq | |||
| TWiki | /cgi-bin/login | admin | http://twiki.org/ | http://exploitsdownload.com/search?q=twiki | ||
| Typo | ||||||
| TYPO3 | /typo3 | admin | password | http://wiki.typo3.org/TYPO3_Installation_Basics | http://exploitsdownload.com/search?q=typo3 | |
| uCoz | /admin | |||||
| Umbraco | /umbraco/login.aspx | admin | default | http://our.umbraco.org/ | ||
| VosaoCMS | /cms | admin@test.com | admin | |||
| WebGUI | root | http://www.exploitsdownload.com/search?q=webgui | ||||
| Webnodes CMS | ||||||
| WolfCMS | /admin/ | http://www.wolfcms.org/wiki/books:administration | http://www.exploitsdownload.com/search?q=wolfCMS | |||
| WordPress | /wp-admin/ | admin | http://codex.wordpress.org/ | Why are you looking HERE for WP? | http://www.exploitsdownload.com/search?q=Wordpress | |
| Wuzly | /admin/login.php | Administrator | 100 | http://osvdb.com/search/search?search[vuln_title]=wuzly | ||
| Xaraya | ||||||
| XOOPS | /admin.php | admin | admin | xoops.org | http://www.exploitsdownload.com/search?q=XOOPS | |
| Xpress Engine | /index.php?module=admin | http://xpressengine.org | http://www.exploitsdownload.com/search?q=XpressEngine | |||
| Yanel | .com:8080/yanel/ | http://yanel.wyona.org/en/documentation/index.html | ||||
| Zikula | /admin.php or user.php | http://phpxref.zikula.de/nav.html?system/Admin/lib/Admin/Controller/Admin.php.html | http://www.cvedetails.com/vulnerability-list/vendor_id-10810/Zikula.html | |||
| Zotonic | admin | admin | Written in Erlang |
