Attackers often target default settings that remain unchanged after installation. Common pairs include:

: Features massive, curated datasets like "Weakpass 4A," which contains over 8 billion unique passwords for intensive audits.

For targeting network devices or servers with factory settings, these lists are highly specialized: SecLists FTP Better Default : A curated list focusing specifically on FTP-specific default passwords found in the industry-standard SecLists repository BruteX FTP User/Pass : A combined list of FTP default username and password pairs BruteX project General Default Credentials : The broad default-passwords.txt Daniel Miessler's SecLists

: Offers curated wordlists designed to minimize "junk guesses" and focus on entries that surface real risks. Most Common FTP Default Credentials

: A classic, large-scale list derived from historical breaches. It is the "household name" for brute-forcing human-selected passwords and is pre-installed in Kali Linux .

The following resources are widely considered the gold standard for security professionals:

admin:admin admin:password Administrator:12345 ftp:ftp user:pass root:root nas:nas

Passwords/Common-Credentials/top-20-common-SSH-FTP.txt : Optimized for service-specific brute forcing.