Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
2026-08-13

Vulnerability Scanning

Scan for Exposed Admin Panels

Probe URL lists for admin panels across stacks, then try vendor default credentials on a subset. Headers and rate-limit included for fleet-scale runs.

Agent

What Scan for Exposed Admin Panels does

Exposed admin panels are management login UIs left reachable on the web, and a vendor default credential on one is a fast path to takeover. This module probes a URL list for admin panel detection across stacks, then tries default credentials on a subset of the panels it finds. A login page found is detection, not a login that worked.

You feed a list of live URLs. This module probes known administrative login UIs across stacks, then tries vendor default credentials on a subset of those panels. A login page found is not a login that worked. Recursive checks walk input URL path prefixes, not a directory wordlist.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Probe for Web Servers writes the URL list. Optionally nest Discover Paths via Crawling or Discover Paths via Directory Brute Force first so the prefixes you hand this module are deeper than /.

Downstream

findings into Generate Scan Report.

Parallel

Nest the four exposure modules on the same URL list after probe: this page, backups, secrets, and sensitive files. Same face, four artifact classes. Web default credentials are this module; SSH, FTP, and database passwords are Scan Network Services for Weak Credentials on the network tail.

When to use this

Nest this after you have live web URLs and you want management login UIs, then default-cred checks on a subset of those UIs. A root-only list only sees panels at those prefixes. Crawl or directory brute force first if you need deeper path prefixes under the same hosts.

Inputs and outputs

Required

  • urls (FILE): live web URLs, one per line. Example: https://foo.example.com.

Optional

  • header (STRING): header(s) to include in HTTP requests.

  • header-file (FILE): the same headers, from a file.

  • rate-limit (STRING, default 300 per second per machine): a ceiling, not

  • findings (FILE): JSONLines. Each row carries finding, location, severity,

Data

The tables this module produces. Sample rows are illustrative.

findings9 columns · 3 sample rows

Detected admin/login panels and default-credential hits on a subset of them.

findingtext
locationurl
severitytext
hostnametext
domain_nametext
ip_addresstext
methodtext
descriptiontext
requesttext
1Pulse Secure VPN Login Panelhttps://vpn.example.com/dana-na/auth/url_default.cgiinfovpn.example.comexample.com203.0.113.10GETAdministrative login UI detected at a known admin path.GET /dana-na/auth/url_default.cgi HTTP/1.1
2Apache Tomcat Manager Panelhttps://app.example.com/manager/htmlinfoapp.example.comexample.com203.0.113.20GETTomcat management interface reachable.GET /manager/html HTTP/1.1
3Default Credentials Confirmedhttps://admin.example.com/admin/login.phphighadmin.example.comexample.com198.51.100.42POSTVendor default credentials accepted on the login form.POST /admin/login.php HTTP/1.1

How it differs from similar modules

Scan for Exposed Admin Panels

Artifact class it owns

Management / login UI; default creds on a subset

Upstream it needs

live urls

Find backup dumps and archives left in the web root

Artifact class it owns

Hostname-named .bak/.sql/zip/tarball

Upstream it needs

live urls

Find tokens and credentials in live HTTP responses

Artifact class it owns

Patterns in the response you fetched

Upstream it needs

live urls

Scan for exposed config files and logs

Artifact class it owns

.env, .git/config, logs, dev artifacts

Upstream it needs

live urls

questions

Scan for Exposed Admin Panels questions

No. You are probing known admin-panel paths across stacks, plus custom paths from v1.3.0, not spraying a generic content-discovery wordlist. For wordlist-based path discovery, nest [Discover Paths via Directory Brute Force](/library/modules/discover-paths-via-directory-brute-force) upstream, then point this module at the deeper URL list.

No. A panel finding means the login UI was detected, usually at info. Default credentials are checked on a subset of found panels. A confirmed default login is a separate row.

No. Default credentials run on a subset of found panels, not all of them. A panel found is not admin/admin on every 200.

No. This module finds web management login UIs and tries vendor defaults on a subset over HTTP. SSH, FTP, MySQL, PostgreSQL, and Microsoft SQL Server live on [Scan Network Services for Weak Credentials](/library/modules/scan-network-services-for-weak-credentials). Do not cross the tails.

No. v1.2.0 walks prefixes of the URLs you already supplied. If you need unlinked `/admin` under a path you never listed, that is directory brute force, then this module.

No. Configs, logs, and VCS files at known paths are [Scan for Sensitive Files](/library/modules/scan-for-sensitive-files). Hostname-named archive dumps are [Scan for Exposed Backups](/library/modules/scan-for-exposed-backups). This module finds administrative login UIs and checks a subset for default credentials.

Yes. v1.3.0 added custom admin panel path checks alongside the known paths across stacks. Custom paths extend coverage but cannot cover a path nobody has listed.

Related modules

  1. Scan for Exposed Backups

  2. Scan for Exposed Secrets

  3. Scan for Sensitive Files

  4. Probe for Web Servers

  5. Discover Paths via Directory Brute Force

  6. Discover Paths via Crawling

  7. Discover Paths via OSINT Sources

  8. Generate Scan Report

  9. Scan Network Services for Weak Credentials

  10. Directory and Content Discovery

  11. Directory brute-forcing

  12. OWASP Top Ten

Nest Scan for Exposed Admin Panels in a workflow

Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.

Build with Scan for Exposed Admin PanelsBrowse modules

Get a personalized demo

See Trickest in Action

A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.

Book a demoExplore the platform