Your Ultimate Pentesting Arsenal
Weak or predictable passwords
Sessions that don't expire
Multi-factor authentication not implemented