You are viewing a free preview of this lesson.
Subscribe to unlock all 10 lessons in this course and every other course on LearningBro.
Security misconfiguration is one of the most common and easily exploitable vulnerability classes. It occurs when security settings are not defined, implemented, or maintained correctly. Unlike code-level bugs, misconfiguration issues affect the infrastructure, platform, and deployment of an application.
Security misconfiguration covers a broad range of issues:
Many platforms, databases, and admin panels ship with default usernames and passwords:
| Platform | Default Credentials |
|---|---|
| Apache Tomcat Manager | admin/admin or tomcat/tomcat |
| phpMyAdmin | root/(blank) |
| Jenkins | admin/(auto-generated but often unchanged) |
| MongoDB | No authentication by default |
| Elasticsearch | No authentication by default (pre-8.x) |
| Default routers | admin/admin or admin/password |
Action: Change all default credentials before deployment. Better yet, disable default accounts entirely.
Subscribe to continue reading
Get full access to this lesson and all 10 lessons in this course.