Equifax Argentinian portal secured with admin/admin
I used to jokingly call my Matasano partner daveg "admin/admin", because he would unironically check for admin/admin before testing in earnest. You'd laugh, because in our field you're supposed to break in with a memory corruption exploit that you worked out remote and black-box. But there he is, every Nth test (for single-digit N's), with an admin login.<p>This stuff is a lot more common than we like to acknowledge.<p>Unrelated tale of interest: I did my first web pentest in 2005 (I've been doing security work since '94-95, but I was a developer for several years before 2005 and missed the start of web pesting). And, I shit you not, the very first input I tested --- a login form --- had a 'OR''=' SQL injection on a plaintext password lookup. It warped my expectations for what to expect on web pentests for years.