Episode 183 | OWASP Top 10 Part 2: Security Misconfigurations That Get You Hacked

Security misconfiguration is one of the most frequently found vulnerabilities in web application pen testing — and most of the fixes are just a checkbox. In Part 2 of their OWASP Top 10 series, Brad Causey and Jordan Natter cover OWASP A05: Security Misconfiguration with real stories from recent engagements and practical takeaways for developers, security teams, and organizations of all sizes.In this episode:Hardcoded Active Directory credentials and API keys discovered in a public GitHub repo during a healthcare pen testDefault credentials (admin/1234) found on a clinical research app storing PHIA rogue Apache basic auth panel that survived from dev into productionHow verbose error handling and stack traces hand attackers a roadmap to your appWhy dev-to-production is the most dangerous transition in your app's lifecycleThe shift-left mindset and DevSecOps — empowering devs to ship secure codeHow CIS lockdown guides can dramatically improve your security posture overnightResources mentioned:OWASP Top 10: OWASP Top Ten Web Application Security Risks | OWASP FoundationCIS Benchmarks: https://www.cisecurity.org/cis-benchmarksEp. 182 – OWASP Top 10 Part 1: https://youtu.be/BwYJ-kZ3XaYNeed a web application pen test? Reach out: Offensive Security - SecurIT360Blog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.comWork with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.