4 ms·

Thanks! #2 definitely seems like a big issue. I can imagine many "internal" services that are potentially insecure.

• Vendan 10y ago
  My fav is IPMI. Many devices allow you to log in using cipher 0... basically, if you know the username, you get access. The rest... well, IMPI has a hash disclosure built into the protocol. If you can guess a username, you can get (and try to crack) the password.