If you have ever set up a router at home, you may have seen a sticker on the back that reads something like Username: admin / Password: admin. That sticker is not a coincidence — it is a feature. Factory defaults let devices and software work straight out of the box without any configuration. The problem arises when those defaults are never changed.
What is Security Misconfiguration?
Security Misconfiguration is the fifth entry on the OWASP Top 10 (A05:2021), and it covers a wide category: any situation where a system, service, or application is deployed with an insecure setup. This includes:
- Unchanged default credentials — the username and password that shipped with the product
- Unnecessary features enabled — debug consoles, sample applications, or admin interfaces left exposed
- Missing security headers — HTTP response headers that protect browsers from common attacks
- Verbose error messages — stack traces that reveal database schemas, library versions, or internal paths
- Open cloud storage buckets — publicly readable containers holding private data
All of these share the same root cause: the software was installed, but it was never secured.
Why default credentials are so dangerous
When software ships with default credentials, every attacker in the world knows them. They are published in vendor documentation, listed in community wikis, and compiled into automated scanning tools.
An attacker does not need to guess — they just need to try the known defaults. A misconfigured application is compromised the moment it is connected to the internet.
How common is this in the real world?
Extremely common. In 2016, the Mirai botnet hijacked over 600,000 Internet-of-Things devices — routers, cameras, and DVRs — almost entirely because they were still running with factory-default credentials. The botnet then launched some of the largest distributed denial-of-service attacks ever recorded, knocking major websites offline for hours.
Default credential attacks are also a standard early step in professional penetration testing. Practitioners always try known defaults before attempting anything more sophisticated, because applications are misconfigured far more often than most people expect.
Security Misconfiguration is ranked #5 on the OWASP Top 10 (A05:2021) and is one of the most broadly applicable categories — it affects web applications, APIs, cloud services, network devices, and developer tools alike.
What you will do in this lesson
You will attack a purpose-built practice application called Pensive Notes — a fictional note-taking service deployed with default admin credentials that were never changed.
Your goal: log in to the admin account using the factory-default credentials, access the admin dashboard, and capture the challenge flag. No SQL injection, no browser exploits — just a username and password that should have been changed on day one.
Everything happens in your browser. No software to install, no terminal to open.