Initial attack vector

Let’s start by connecting to our web page. Browse to https://webserver-workshops.fdlabs.dev and you should see the developer portal

This portal is meant to be used by developers to debug internal services before they were published to the internet. As you can see this portal is protected by simple username/password authentication - there is no 2 factor or certificate based authentication.

Let’s try logging in with a typical default username/password combination of admin and hunter2.

We are successfully logged in but as we discussed earlier this webserver does not have direct access to any sensitive data.

What can possibly go wrong?