password AfXNtpa38x

[neusbeer]

I was busy pentesting ip cam's. and found a 'strange' thing.
I use noisy scanning with Acunetix (yeah I'm lazy), and it bruteforce about
40 passwords including this one.
Example log of Acunetix scan: [size=78%]http://www.webprocomponents.com/photographer-portfolio-pro/Wildlife-portfolio1-demo/admin/attackers/94.220.67.55.log[/size]
(see the bruteforce part) note, this ain't my log


When testing a ipcam, the actual password of the HTTP Auth was AfXNtpa38x.
Not really a password you see everyday, and when I google it, there aren't many hits. (only a leak pastebin with also the same password in it. http://pastebin.com/2vMgHkYk)

Why does this (dutch) IP cam have this password.


Am I missing something? is this a standard password for IP cam's of this type or somekind of buildin hardcoded password.

[Phage]

Is it weird that people put passwords on their internet connected cams? Just asking...

[vezzy]

Is it weird that people put passwords on their internet connected cams? Just asking...

It's not weird at all unless you intend on having script kiddies searching for cams on SHODAN to conduct surveillance on you.

[neusbeer]

But why is it in a the wordlist of Acunetix scanner, which uses a small list of often used passwords and the password of a random cam. how big is the chance.

[Stackprotector]

This is indeed a strange fact. Though the password also appears on that example list you shared. You sure it's only 40 passwords? Maybe it's a very specific brand default password or something underground?

[neusbeer]

Code: [Select]

around 40 yeah. like password,123456 etc.. ain't that much..
Acunetix uses fast bruteforce with a few standard words to speed up..
(still slow though..)
I think brand password..


[Phage]

It's not weird at all unless you intend on having script kiddies searching for cams on SHODAN to conduct surveillance on you.

You clearly didn't get the irony.

[Silent Infiltrator]

I have literally 0% with IP cams. But my personal instincts would say that a certain brand must use this password, or a certain model?

[Kulverstukas]

Well it's logical that the IP cams use a default password, like many things such as routers and shit. People just forget or don't care enough, to change that password.

[lucid]

You clearly didn't get the irony.

I think he was adding to yours

[neusbeer]

Well it's logical that the IP cams use a default password, like many things such as routers and shit. People just forget or don't care enough, to change that password.

True, but this ain't the standard password, that's admin:admin I think.
looks more like vendor password or such.