In this post, you will see an example of security misconfiguration which is one of the top 10 security vulnerabilities as per OWASP top 10 security vulnerabilities.
Here is what security misconfiguration means?
Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc to gain unauthorized access or knowledge of the system. In this post, you will see the example of unauthorized knowledge of the system.
Security Misconfiguration Example
This morning, I was checking the Upwork.com when I saw this message when I tried to login. Take a look at exceptions and stack trace.
Using the above, I could extract some of the following information in relation to software stack used for building Upwork and design one or more attack vector for hacking purpose.
- Java is used in the backend
- Jetty server looks to be used
- Netflix Hystrix is used for latency and fault tolerance
- Usage of some of the following jar files
- httpcore.jar
- httpclient.jar
- dropwizard-client.jar
- jersey-client
- guice-servlet
Check out my latest book titled as First Principles Thinking: Building winning products using first principles thinking. Check out my other blog, Revive-n-Thrive.com
- MSE vs RMSE vs MAE vs MAPE vs R-Squared: When to Use? - April 25, 2024
- Gradient Descent in Machine Learning: Python Examples - April 22, 2024
- Loss Function vs Cost Function vs Objective Function: Examples - April 19, 2024
Leave a Reply