Top 5 Vulnerabilities Found During Penetration Testing: Lessons from Our Webinar

Improper server, software, or cloud settings, or use of default credentials.

If businesses are not using security hardening standards on their servers or workstations, pentesters can simulate man-in-the-middle attacks to very quickly gain access to credentials and passwords. One of the most common misconfigurations our pentesters find are weak and predictable passwords.

We find that many businesses stay current with patching their workstations and servers. But they often miss IoT devices, cameras, switches, and firewalls, because these systems are not part of their automated patching processes. These require more manual patching and come with greater downtime or maintenance requirements, so many businesses fall into the trap of ‘set up and forget.’ This provides hackers with an easy entryway to gain access to the keys to the kingdom.

Typically, if a web application does not have a good Quality Assurance (QA) testing solution in place, attackers can easily perform injection attacks to create holes in the code. This way, hackers can provide SQL or XML queries to, for instance, get passwords from the server or exfiltrate other sensitive data. These security gaps are often resolved through patching. Nowadays, however, there are many homegrown apps, especially with the rise of AI. Many businesses are attempting to write their own code, and while these apps they create may be functional, they are not always secure. This creates more vulnerabilities.

Users gaining access to data or functions beyond their permissions.

This is another common vulnerability we often encounter, especially in cloud environments like AWS and Azure or in Active Directory, usually caused by incorrectly configured user roles or permissions. These common misconfigurations create room for privilege escalation attacks.
Once our pentesters obtain any kind of credentials, the next thing they do is see how far they can move laterally within the environment. And, often, they can very quickly exploit privilege escalation vulnerabilities, effectively gaining full administrative control.

Successful phishing or vishing attacks that exploit human error.

Today, more people are good at identifying fraudulent emails, text messages, and phone calls. However, social engineering tactics are also becoming more sophisticated with deepfakes and well-crafted emails that seem legitimate.

Enforce secure coding practices and code reviews to prevent SQL injections.

Apply the principle of least privilege, review user permissions and other security configurations.