Web Application Security · 3.4
⚙️ Misconfiguration & Weak Auth
The unglamorous flaws behind most real breaches⏱ ~2 min
Security Misconfiguration
The most common real-world weaknesses aren't clever exploits — they're systems set up carelessly. Misconfiguration means the software could be secure, but wasn't set up that way.
- •Default credentials left unchanged — admin/admin, or the manufacturer's default password
- •Exposed admin panels — management interfaces reachable from the public internet
- •Verbose error messages — leaking system details, versions, or even code to attackers
- •Unnecessary features enabled — every extra service is another potential door
- •Directory listing on — the web server showing all files in a folder to anyone
- •Default sample content — leftover test pages and accounts from installation
Identification & Authentication Failures
This category covers weaknesses in how a system verifies who you are — the login and session machinery. It connects directly to everything in the Cryptography module's authentication unit.
| Weakness | Why It's Dangerous |
|---|---|
| Allowing weak passwords | 'password123' falls instantly to guessing attacks |
| No brute-force protection | Attackers can try unlimited passwords (no lockout/rate limit) |
| No MFA option | A single stolen password = full account takeover |
| Weak session tokens | Predictable session IDs let attackers hijack logged-in sessions |
| Exposing whether a username exists | Helps attackers build lists of valid accounts to target |
🔒 SecurityDefenses tie back to fundamentals you've already learned: enforce strong passwords, require MFA, hash passwords with Argon2/bcrypt, rate-limit login attempts, and use secure random session tokens. The Cryptography module's authentication unit covers the 'how' in depth — this is where it gets applied.
★ FactThis is why the boring advice matters so much. Change default passwords, keep software updated, turn off what you don't need, enable MFA. These unglamorous habits prevent the majority of real-world breaches — far more than any advanced technique.
🧠Quick Checkfirst try = +5 XP
Which is a 'security misconfiguration'?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days