The Cyber Threat Perspective
Step into the ever-evolving world of cybersecurity with the offensive security group from SecurIT360. We’re bringing you fresh content from our journeys into penetration testing, threat research and various other interesting topics.
brad@securit360.com
The Cyber Threat Perspective
Episode 183 | OWASP Top 10 Part 2: Security Misconfigurations That Get You Hacked
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Security misconfiguration is one of the most frequently found vulnerabilities in web application pen testing — and most of the fixes are just a checkbox. In Part 2 of their OWASP Top 10 series, Brad Causey and Jordan Natter cover OWASP A05: Security Misconfiguration with real stories from recent engagements and practical takeaways for developers, security teams, and organizations of all sizes.
In this episode:
- Hardcoded Active Directory credentials and API keys discovered in a public GitHub repo during a healthcare pen test
- Default credentials (admin/1234) found on a clinical research app storing PHI
- A rogue Apache basic auth panel that survived from dev into production
- How verbose error handling and stack traces hand attackers a roadmap to your app
- Why dev-to-production is the most dangerous transition in your app's lifecycle
- The shift-left mindset and DevSecOps — empowering devs to ship secure code
- How CIS lockdown guides can dramatically improve your security posture overnight
Resources mentioned:
- OWASP Top 10: OWASP Top Ten Web Application Security Risks | OWASP Foundation
- CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks
- Ep. 182 – OWASP Top 10 Part 1: https://youtu.be/BwYJ-kZ3XaY
Need a web application pen test? Reach out: Offensive Security - SecurIT360
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
