CIRT.net – Default Password Database

US-CERT – Risks of Default Passwords on the Internet

SANS Whitepaper – Vendor-Supplied Backdoor Passwords – A Continuing Vulnerability

Open Web Application Security Project (OWASP) – Testing for Account Enumeration and Guessable User Account

Nikto2 – Web Application Scanner

Open Web Application Security Project (OWASP) – Testing for Default Credentials

SANS – Password Construction Guidelines

SANS – Password Protection Policy