Testing default credentials in web applications