Default-credential checks

What it is

A non-LLM, fully-deterministic check that runs the nuclei default-logins template tree against an authorised service. No reasoning loop, no API tokens spent: just the same well-known weak-credential checks every pentester runs first, automated and audit-logged.

What it produces

For each service checked:

• A list of any matched default-credential combinations (with the exact request/response that proved it)
• One finding per match, recorded in the same findings table as AI-driven discoveries, so they show up in the same dashboard and reports
• The matched product’s category badge (“Web admin panel”, “DB admin”, “Router admin”, etc.)

What to use it for

• New-acquisition triage: “did they leave any boxes on default admin passwords?”
• M&A due diligence: cheap, audit-ready evidence the surface is / isn’t credential-exposed
• The pre-AI quick win: scan a target, immediately default-check, THEN spend AI tokens on the harder CVEs

Why it matters

Default credentials are still in the OWASP Top 10 and CISA’s Known-Exploited Vulnerabilities catalogue. Most security tools don’t check them because the checks look “noisy”, but tools that DO check them find them constantly. We make the check first-class and cost-free at runtime.

Why it’s valuable

• No LLM token cost. Free to run on every service.
• Deterministic. Run it twice on the same service, get the same result. Patch and re-run, the row flips green.
• Same findings pipeline. Default-credential hits get the same ticketing / sharing / replay treatment as AI verdicts.

How to use it

1. Open a service detail drawer.
2. Click Run default-credential test.
3. Result lands in the findings dashboard within seconds.

Or via the API:

POST /api/default-logins
{ "service_id": 12345 }

You authorise the test; we record that you did. Don’t run this against services you don’t own. That’s a CFAA / Computer Misuse Act issue, and the checkbox is a record we asked.