Which protocols are supported?

SSH, FTP, MySQL, PostgreSQL, and Microsoft SQL Server. The list is closed. RDP, Telnet, SMB, VNC, and Redis are not added on request.

Will this lock accounts?

It can. The rate-limit exists because lockout is a real risk on authentication endpoints. Lower it, stage against non-production accounts, and confirm your authorization covers credential testing before you run.

Can I run it without fingerprinting?

No. The required input is `network-service-details` from fingerprint network services. If you only have open ports, run fingerprint first. The misconfig sibling can take raw port records. This one cannot.

Does it check web admin panels?

No. Web admin login UIs and HTTP default credentials are find web admin panels. This module tests network protocols only.

Can I use custom username and password wordlists?

Yes. Per-protocol wordlists for SSH, FTP, MySQL, PostgreSQL, and Microsoft SQL Server are all optional FILE inputs. Custom lists are how you spray. Bring your own rather than relying on defaults.

What is a successful match?

A weak credential, not a full compromise story. Triage still has to confirm what the account can reach. A match tells you the login worked, not what that login exposes.

2026-08-13

Vulnerability Scanning

Scan Network Services for Weak Credentials

Test weak credentials on SSH, FTP, MySQL, PostgreSQL, and Microsoft SQL Server with per-protocol wordlists. Lockout-aware rate-limit keeps runs safe.

What Scan Network Services for Weak Credentials does

Weak credentials on network services are vendor defaults and easy passwords on SSH, FTP, and databases that an authorized assessment has to catch before an attacker does. This module runs weak credential testing across five protocols, with per-protocol wordlists and a rate-limit that accounts for lockout risk. Account lockout is real, so the rate-limit is there to manage it.

On authorized scope only, you test vendor, default, and weak logins on five protocols: SSH, FTP, MySQL, PostgreSQL, and Microsoft SQL Server. There is no sixth protocol. Account lockout is a real risk; the rate-limit exists because of it. You need network-service-details from fingerprinting. Raw open ports are not enough.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Fingerprint network services produces network-service-details. Scan for open ports is the hop before that. You cannot wire this module onto raw port-details.

Downstream

findings feed the scan report.

Parallel

Scan network services for misconfigurations runs on the same network tail, tests config rather than logins, and may skip fingerprinting. Do not cross into the web tail. HTTP admin-panel default credentials belong on find web admin panels.

Network tail (this page is one of the two last hops): hosts -> open-ports -> network FP -> (misconfig | weak-creds). Fingerprinting is required for this hop. Never hosts -> probe-web -> web FP.

When to use this

Nest this after fingerprint network services has named the service. You cannot skip that hop. If you only have port-details, run fingerprint first. Misconfig can take raw port records; this cannot. Confirm the engagement covers credential testing before you nest it.

Inputs and outputs

Required: network-service-details (FILE): JSONL records from fingerprint network
Optional: rate-limit (STRING): maximum requests per second per machine. Default 300.
Per-protocol username and password wordlists (FILE), all optional:
Outputs: findings: JSONL records (finding, location, severity, ip_address,

Data

The tables this module produces. Sample rows are illustrative.

findings9 columns · 3 sample rows

Weak, vendor-default, or default credentials confirmed on a network service.

	findingtext	locationurl	severitytext	hostnametext	ip_addresstext	portint	protocoltext	usernametext	passwordtext
1	FTP Weak Credentials	ftp://203.0.113.10:21	high	ftp.example.com	203.0.113.10	21	ftp	admin	admin
2	MySQL Weak Credentials	mysql://203.0.113.20:3306	high	db.example.com	203.0.113.20	3306	mysql	root	root
3	SSH Weak Credentials	ssh://198.51.100.42:22	high	ssh.example.com	198.51.100.42	22	ssh	root	toor

How it differs from similar modules

Scan for open ports

Artifact class it owns

Which TCP ports answer

Upstream it needs

hosts

Fingerprint network services

Artifact class it owns

Protocol, banner, product on each open port

Upstream it needs

port-details

Scan network services for misconfigurations

Artifact class it owns

Setup issues on named (or raw) services

Upstream it needs

port-details (FP optional)

Scan Network Services for Weak Credentials

Artifact class it owns

Vendor/default/weak logins on five protocols

Upstream it needs

network-service-details (FP required)

Find web admin panels is HTTP login UIs and a subset of default creds over the web tail. This module tests five network protocols only.

questions