为什么值得关注

系统记录了默认凭据和暴露模式，使安全工程师能够快速检查并验证多种产品的凭据表面，从而减少因默认或弱凭据而导致的攻击面。

适合谁使用

安全工程师
渗透测试人员
DevOps/SRE团队
产品安全团队

典型使用场景

在部署时审计默认凭据
验证云/SaaS配置中的凭据暴露
为加固指南构建安全检查清单
研究凭据模式以进行漏洞评估

项目优势

社区驱动且开源（CC BY 4.0）
结构化的YAML格式便于机器读取
涵盖多种类别（监控、云等）并附有官方文档和公告的引用
包括静态默认凭据和生成凭据及其位置模式

使用前须知

覆盖范围依赖社区贡献，可能不包含所有产品
条目基于公开信息，可能不涵盖所有未文档化的行为
不包含实时泄露的凭据或泄露数据（设计如此）

README 快速开始

LOLCreds Data

This repository contains the YAML data entries for LOLCreds - Living Off the Land Credentials.

LOLCreds is a catalog of public credential defaults, credential locations, and exposure patterns for real products, SaaS/cloud services, appliances, and deployment packages.

The goal is to make product credential surfaces easier to check, understand, validate, explain, and fix.

Structure

Each product is described as a YAML file under entries/.

Example:

entries/adobe-experience-manager.yaml

Each entry may describe:

known defaults;
static default or generated credentials;
undocumented credential behaviors linked to public advisories;
credential locations;
exposure patterns;
what credentials look like;
what they can unlock;
public references.

Example entry

id: grafana
name: Grafana
category: monitoring
vendor: Grafana Labs
author: haxxm0nkey

credentials:

  - id: default-admin
    name: Default Admin Login
    description: >
      Grafana ships with a default admin user for first sign-in. Grafana
      documents the default username and password as admin/admin unless
      changed through configuration or packaging.
    type: username_password
    nature: [static_default]
    sensitivity: secret
    default:
      username: admin
      password: admin
    location:
      - type: public_interface
        path: /login
        detail: Grafana web UI, default port 3000
      - type: config_file
        path: grafana.ini
        detail: '[security] admin_user and admin_password override defaults'
      - type: environment
        path: GF_SECURITY_ADMIN_USER, GF_SECURITY_ADMIN_PASSWORD
      - type: secret_store
        detail: Helm/Kubernetes Secrets, Docker secrets, CI/CD variables
    notes: >
      The first-login password-change prompt is not a substitute for changing
      the default before exposure. Admin access can read dashboards, data
      source configuration, and other stored integration secrets.

  - id: kube-prometheus-stack-admin
    name: kube-prometheus-stack Default Admin
    description: >
      The kube-prometheus-stack Helm chart deploys Grafana with a chart-level
      admin password override commonly set to prom-operator.
    type: username_password
    nature: [static_default]
    sensitivity: secret
    default:
      username: admin
      password

项目描述

Living Off the Land Credentials. Public credential defaults, locations, and exposure patterns for real products, SaaS/cloud services, appliances, and deployment packages.

lolcreds-data