lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Synology DSM

Synologynetwork4 credentials

Credentials4 documented
01

DSM Administrator/User Password

synology-dsm / admin-user-password

Synology DSM uses local and directory users for web, SSH, SMB/NFS/AFP, package, and API access. Newer DSM disables or prompts configuration of the default admin account during setup.

generated on installuser definedsecretusername/password

Location

public interface
DSM web UI, SSH, SMB/AFP/NFS services, WebDAV, package UIs, and Synology APIs
config file

/etc/passwd, /etc/shadow, DSM account/config files, and package configs

database

DSM system/account databases and package user stores

secret store

password managers, Hyper Backup vaults, and directory services

logs

DSM logs, auth logs, SMB logs, and package logs

Notes

No universal DSM admin password is modeled; setup creates or changes administrator credentials.

02

DSM API Session / SynoToken

synology-dsm / api-session-synotoken

DSM web/API sessions use cookies and SynoToken-style CSRF/session tokens for authenticated API calls.

generated on installsecrettoken

Location

http header
Cookie

DSM web/API session cookies such as id or syno session cookies

http header
X-SYNO-TOKEN

Synology API/UI token used by authenticated requests

config file

API client caches, automation scripts, and mobile app traces

logs

reverse proxy, web access, and API debug logs

03

Package, Cloud, Backup, and Integration Secrets

synology-dsm / package-cloud-backup-secrets

DSM packages store secrets for Hyper Backup, Active Backup, Cloud Sync, LDAP/AD, SMTP, DDNS, Docker/Container Manager, surveillance cameras, and package-specific databases.

user definedgenerated on installsecretsecret value

Location

config file

DSM package configuration directories, /usr/syno/etc, Docker Compose projects, and service configs

database

DSM/package databases containing account, token, and integration settings

secret store

DSM internal credential store, Hyper Backup credentials, and external vaults

artifact

configuration backups, Hyper Backup sets, and support dumps

logs

package logs and sync/backup debug output

04

DSM Certificate / SSH Private Key

synology-dsm / certificate-private-key

Synology appliances store TLS certificate private keys, SSH host/user keys, VPN keys, and package-generated key material.

generated on installuser definedsecretkey pair

Looks like

pattern
pattern

private key material from DSM certificates, SSH, or VPN packages

-----BEGIN (RSA |EC |OPENSSH |ENCRYPTED |)PRIVATE KEY-----

Location

config file

DSM certificate directories, SSH key files, VPN package configs, and reverse proxy settings

secret store

certificate stores, backup vaults, and password managers

artifact

system configuration backups and support bundles

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.