Does a finding mean the login worked?

No. A panel finding means the login UI was detected, usually at info. Default credentials are checked on a subset of found panels. A confirmed default login is a separate row.

Does it test every panel for default creds?

No. Default credentials run on a subset of found panels, not all of them. A panel found is not admin/admin on every 200.

Is this the network weak-credential module?

No. This module finds web management login UIs and tries vendor defaults on a subset over HTTP. SSH, FTP, MySQL, PostgreSQL, and Microsoft SQL Server live on [Scan Network Services for Weak Credentials](/library/modules/scan-network-services-for-weak-credentials). Do not cross the tails.

Does recursion replace a dirbust?

No. v1.2.0 walks prefixes of the URLs you already supplied. If you need unlinked `/admin` under a path you never listed, that is directory brute force, then this module.

Is this the sensitive files or backups scanner?

No. Configs, logs, and VCS files at known paths are [Scan for Sensitive Files](/library/modules/scan-for-sensitive-files). Hostname-named archive dumps are [Scan for Exposed Backups](/library/modules/scan-for-exposed-backups). This module finds administrative login UIs and checks a subset for default credentials.

Does it find admin panels at custom paths?

Yes. v1.3.0 added custom admin panel path checks alongside the known paths across stacks. Custom paths extend coverage but cannot cover a path nobody has listed.

2026-08-13

Vulnerability Scanning

Scan for Exposed Admin Panels

Probe URL lists for admin panels across stacks, then try vendor default credentials on a subset. Headers and rate-limit included for fleet-scale runs.

What Scan for Exposed Admin Panels does

Exposed admin panels are management login UIs left reachable on the web, and a vendor default credential on one is a fast path to takeover. This module probes a URL list for admin panel detection across stacks, then tries default credentials on a subset of the panels it finds. A login page found is detection, not a login that worked.

You feed a list of live URLs. This module probes known administrative login UIs across stacks, then tries vendor default credentials on a subset of those panels. A login page found is not a login that worked. Recursive checks walk input URL path prefixes, not a directory wordlist.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Probe for Web Servers writes the URL list. Optionally nest Discover Paths via Crawling or Discover Paths via Directory Brute Force first so the prefixes you hand this module are deeper than /.

Downstream

findings into Generate Scan Report.

Parallel

Nest the four exposure modules on the same URL list after probe: this page, backups, secrets, and sensitive files. Same face, four artifact classes. Do not share one H1. Web default credentials are this module; SSH, FTP, and database passwords are Scan Network Services for Weak Credentials on the network tail.

When to use this

Nest this after you have live web URLs and you want management login UIs, then default-cred checks on a subset of those UIs. A root-only list only sees panels at those prefixes. Crawl or directory brute force first if you need deeper path prefixes under the same hosts.

Inputs and outputs

Required: urls (FILE): live web URLs, one per line. Example: https://foo.example.com.
Optional: header (STRING): header(s) to include in HTTP requests.
header-file (FILE): the same headers, from a file.
rate-limit (STRING, default 300 per second per machine): a ceiling, not
findings (FILE): JSONLines. Each row carries finding, location, severity,

Data

The tables this module produces. Sample rows are illustrative.

findings9 columns · 3 sample rows

Detected admin/login panels and default-credential hits on a subset of them.

	findingtext	locationurl	severitytext	hostnametext	domain_nametext	ip_addresstext	methodtext	descriptiontext	requesttext
1	Pulse Secure VPN Login Panel	https://vpn.example.com/dana-na/auth/url_default.cgi	info	vpn.example.com	example.com	203.0.113.10	GET	Administrative login UI detected at a known admin path.	GET /dana-na/auth/url_default.cgi HTTP/1.1
2	Apache Tomcat Manager Panel	https://app.example.com/manager/html	info	app.example.com	example.com	203.0.113.20	GET	Tomcat management interface reachable.	GET /manager/html HTTP/1.1
3	Default Credentials Confirmed	https://admin.example.com/admin/login.php	high	admin.example.com	example.com	198.51.100.42	POST	Vendor default credentials accepted on the login form.	POST /admin/login.php HTTP/1.1

How it differs from similar modules

Scan for Exposed Admin Panels

Artifact class it owns

Management / login UI; default creds on a subset

Upstream it needs

live urls

Find backup dumps and archives left in the web root

Artifact class it owns

Hostname-named .bak/.sql/zip/tarball

Upstream it needs

live urls

Find tokens and credentials in live HTTP responses

Artifact class it owns

Patterns in the response you fetched

Upstream it needs

live urls

Scan for exposed config files and logs

Artifact class it owns

.env, .git/config, logs, dev artifacts

Upstream it needs

live urls

questions