CHANGEME(1)

okay bestie, pull up a chair 💖 this is CHANGEME, it lives in section 1 of the manual (the "User Commands" corner of the world), and it is so good at what it does. Let's get into it. ✨

---

🌸 NAME 🌸

changeme — a Default Credential Scanner. That's the name, that's the job, no notes. 👑

💖 DESCRIPTION 💖

It's a Default Credential Scanner with support for various protocols. Like, it goes around checking whether things are still rocking their factory-default logins. Iconic behaviour honestly. 🦋

🎀 SYNOPSIS 🎀

changeme [options] <target>

✨ OPTIONS ✨

required arguments: (yes, you actually have to give it one, sorry 💅)

• target — the thing you want scanned. It can be an IP, a subnet, a hostname, an nmap xml file, a text file, or proto://host:port. Choose your fighter.

optional arguments: (the lil extras, all of them, every single one 🫶)

• -h, --help — pops up this help message and dips out. classic.
• --all, -a — scan for all the protocols. go big or go home.
• --category, -c _CATEGORY_ — which category of default creds you wanna scan for.
• --contributors — shows you the legends who contributed the cred files. give them their flowers. 💐
• --debug, -d — debug output, for when you need to see everything.
• --delay, -dl _DELAY_ — sets a delay in milliseconds so you don't get slapped with 429 status codes. default is 500.
• --dump — prints out all the loaded credentials. everything, on the table.
• --dryrun — prints the urls it would scan but does not scan them. window shopping, basically.
• --fingerprint, -f — fingerprints the targets but doesn't check any creds. vibes only.
• --fresh — flushes any previous scans and starts fresh. clean slate energy. 🧼
• --log, -l _LOG_ — writes the logs out to a logfile.
• --mkcred — makes a cred file.
• --name, -n _NAME_ — narrows the testing down to just the credential name you supply.
• --noversion — skips the version check. don't do the version check, we're not doing it.
• --proxy, -p _PROXY_ — HTTP(S) Proxy.
• --output, -o _OUTPUT_ — the name of the result file. the file extension decides the type (csv, html, json).
• --oa — outputs the results files in csv, html and json formats. all three, greedy queen.
• --protocols _PROTOCOLS_ — a comma separated list of protocols to test: http,ssh,ssh_key. defaults to http.
• --portoverride — scans all protocols on all the ports you specified.
• --redishost _REDISHOST_ — Redis server.
• --redisport _REDISPORT_ — Redis server.
• --resume, -r — resumes the previous scan. where were we? 💭
• --shodan_query, -q _SHODAN_QUERY_ — Shodan query.
• --shodan_key, -k _SHODAN_KEY_ — Shodan API key.
• --ssl — forces the cred to SSL, and if an SSLError happens it falls back to non-SSL.
• --threads, -t _THREADS_ — number of threads, default is 10.
• --timeout _TIMEOUT_ — timeout in seconds for a request, default is 10.
• --useragent, -ua _USERAGENT_ — the user agent string to use.
• --validate — validates the creds files.
• --verbose, -v — verbose output. tell me everything. 🗣️

---

🔥 EXAMPLES 🔥

scan a single host, simple as:

changeme 192.168.2.100

Scan single host

whole subnet? say less:

changeme 192.168.2.0/24

Scan subnet

got an nmap output file? flex it:

changeme subnet.xml

Scan using a nmap output file

go hunting for Tomcat creds on a subnet and set the timeout to 5 seconds:

changeme -n "Apache Tomcat" --timeout 5 192.168.2.0/24

Scan a subnet for Tomcat default creds and set the timeout to 5 seconds

let Shodan build you a targets list, then check them all for default creds:

changeme --shodan_query "Server: SQ-WEBCAM" --shodan_key keygoeshere -c camera

Use Shodan to populate a targets list and check them for default credentials

SSH and known SSH keys across the whole subnet:

changeme --protocols ssh,ssh_key 192.168.2.0/24

Scan subnet for SSH and known SSH keys

and if you're feeling fancy, use the protocol syntax for SNMP:

changeme snmp://192.168.2.100

Scan a host for SNMP creds using the protocol syntax

---

💜 AUTHOR 💜

changeme was developed by ztgrace — absolute icon. 🫶 This manpage was made by Samuel Henrique <samueloph@debian.org>, built off the changeme --help output, and other projects are welcome to use it too. sharing is caring fr fr.

---

and that's the whole page bestie!! 🌈 this was changeme 1.1.1, dated June 2018, section 1 of the manual — go forth and scan responsibly, ily, bye 💅✨