I remember in my young and foolish days about 20 years ago getting into a big ecommerce site host (think Shopify) because the site let you upload profile pics a

I remember in my young and foolish days about 20 years ago getting into a big ecommerce site host (think Shopify) because the site let you upload profile pics and it didn't check the extension. I quickly wrote and uploaded a file explorer as .ASPX and browsed the file system. Found the DB password in the site config file. Used RDP to connect and tried to log in with administrator using the DB password. Worked. What was the admin password for this huge hosting company? "internet" Another anecdote. Worked for a startup 20 years ago. We had millions of users. For some reason we left all the passwords in plaintext in the DB. One day we decide to query the DB for a sorted list of the most common passwords. They were: password trustno1 12345 123456 12345678 That 2nd one had to have been due to the X-Files still being shown at that point.