Imagine a web server that hands your entire user database — including stored passwords — to any visitor who asks, with no login required. That is exactly what this lesson demonstrates.
In this lesson you will:
- Use your browser's developer tools to inspect an unauthenticated API endpoint that returns every user's account data.
- Identify the administrator account by email address.
- Recognize the signature of an obsolete password hashing algorithm.
- Pick the appropriate replacement.
This lesson touches two OWASP risks: A01:2021 (Broken Access Control) is the delivery mechanism that lets you reach the data, and A02:2021 (Cryptographic Failures) is the primary finding — the weak password hash that the access lets you observe.
Estimated time: 10 to 15 minutes.
Prerequisites: the Cryptography Fundamentals lesson and the Encoding, Encryption & Hashing lesson — both are in the Data, Cryptography & Database Foundations category. You also need a running NovaCart instance.
When you are ready to begin, send the Continue signal.