OWASP Security Shepherd Project - Security Misconfiguration Lesson

What is Security Misconfiguration Vulnerability/Threat?

    Security misconfiguration can happen in any part of an application, from the database server, third-party libraries to custom code settings. A security misconfiguration is any configuration which can be exploited by an attacker to perform any action they should not be able to. The impact of these issues vary from which configuration is being exploited.
    Attackers can exploit security misconfiguration by logging in with default log in credentials to the application, the operating system or any of the public services it is running (Such as Database or Samba services) to gain unauthorized access to or knowledge of the system. Attackers can also exploit bad security configurations through unpatched flaws, unprotected files and directories to gain unauthorized access to or knowledge of the system.
    Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts or unnecessary services. A process should be implemented for keeping all software up to date, with patches occurring in a timely manner to each deployed environment.

Lesson

    This lesson asks us to find the default admin credential which was never removed or updated.
We can only leverage generally used account/password to guess. It turns out to be admin/password.