Common Weak Spots
SECTION 9
Your Progress
x of x sections completed
The Main Types of Vulnerabilities
1. Misconfiguration
What: System set up wrong or left wide open.
Where: Exposed admin panels, open ports, default settings.
Impact: Easy unauthorized access, pivot points.
Example: Jenkins web UI exposed to the internet with no auth.
2. Injection
What: Sending input that executes unintended commands or queries.
Where: Web forms, APIs, search boxes.
Impact: Database dumps, remote code execution, system compromise.
Example: SQL Injection:
' OR 1=1-- 3. Broken Access Control
What: Access granted without proper checks.
Where: Hidden URLs, API endpoints, user role flaws.
Impact: Privilege escalation, unauthorized admin access.
Example:
/admin page accessible
without authentication.
4. Insecure Defaults
What: Systems ship insecure, often with default creds or settings.
Where: IoT devices, CMS installs, routers.
Impact: Initial access without effort.
Example: Router with default
admin:admin login.
5. Unpatched Vulnerabilities
What: Known software flaws left unfixed.
Where: Everywhere — operating systems, web servers, apps.
Impact: Known exploits work out of the box.
Example: EternalBlue exploited SMB flaw (CVE-2017-0144).
How Hackers Really Use Vulnerabilities
Hackers don't care about individual vulnerabilities, they care about attack
chains. One
vulnerability is just one step closer to valuable data.
The cycle looks like this:
- Find weak spot #1 — maybe low impact alone.
- Pivot — use that to access another system or escalate.
- Stack weak spots — chain vulnerabilities.
- Full compromise — access, control, persistence.
Your Key Resource: CVE.org
The CVE database is your go-to
for vulnerability
information.
CVE = Common Vulnerabilities and Exposures
It lists vulnerabilities with IDs like CVE-2023-12345, providing:
- Search for software, version numbers, keywords.
- Get vulnerability ID, description, severity.
- See how others exploit flaws.
Example Workflow:
- You scan a system → find it's running Apache 2.4.49.
- You search
Apache 2.4.49 vulnerabilityon cve.org. - You find CVE-2021-41773. A path traversal + RCE exploit.
- Now you know there's a known weakness. You research the exploit and test safely in lab.
⚠️ Rule: Always verify versions before attacking blindly. Smart hackers research and test first.