How to Harden the Applications You Just Learned to Break

#You Broke Them. Now Make Sure Nobody Else Can.#link

What's the point of learning to exploit WordPress, Tomcat, Jenkins, and Splunk if you can't tell a client how to fix them? Every finding in your report needs a remediation path. And the remediation for most of what we covered in this course comes down to five principles.

Why does the same vulnerability keep appearing across engagements?

Because organizations don't maintain application inventories. They don't know what's running on their network. A sysadmin installs a Splunk trial in 2019. The trial expires. It converts to the free version. No authentication. Nobody remembers it exists. Three years later, a pentester finds it on page 47 of an EyeWitness report and gets SYSTEM.

The five hardening principles

Secure authentication: change every default credential. admin:admin, tomcat:tomcat, prtgadmin:prtgadmin. Disable default accounts entirely and create custom admin accounts with strong passwords. Enforce MFA on all administrative interfaces.

Access controls: restrict admin panels to localhost or specific IP ranges. The Tomcat Manager should never be internet-facing. Jenkins Script Console should require authentication and IP whitelisting. GitLab should require admin approval for new registrations.

Disable unsafe features: turn off PHP editing in WordPress (define('DISALLOW_FILE_EDIT', true) in wp-config.php). Remove the CGI servlet from Tomcat if unused. Disable the Splunk Script Console for non-admin roles. Remove FCKeditor from ColdFusion.

Patch management: Drupalgeddon was patched in 2014, 2018, and 2018 again. Ghostcat was patched in 2020. Shellshock was patched in 2014. These exploits still work because organizations don't patch. Automate updates. Subscribe to vendor security advisories.

Backups and monitoring: configure regular backups so a compromise doesn't mean total data loss. Deploy a WAF in front of internet-facing applications. Monitor for brute-force attempts against admin panels. Alert on WAR file deployments and plugin installations.

You spent this entire course learning how to break into these applications. Now go harden one. Pick a WordPress install, a Tomcat instance, or a Jenkins server in your home lab. Apply every principle above. Then run your own attacks against it and see what still gets through. That's how you build the defender's instinct alongside the attacker's.