> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/common-pentest-findings/insufficient-encryption.md).

# Insufficient Encryption

## Overview

This is the **most** common finding in penetration tests. Having **HTTP** running on any web service should be ranked as **High** because of how easy a **MITM** attack can be if they're on the same network. Using weaker encryption algorithms will have a rank of **Low-Moderate** because of how an adversary would need a **MITM** position and advanced tools to decrypt or get a hold of a session key.

## Example 1

<figure><img src="/files/cT7KDfmoxrgphZE7eHCy" alt=""><figcaption><p>Weak encryption algorithms being used</p></figcaption></figure>

<figure><img src="/files/NN4ZlO5vWDaDeohBgl4q" alt=""><figcaption><p>Evidence and Remediation</p></figcaption></figure>

## Example 2

<figure><img src="/files/MqTa3PPJbAS2AN4FwAbC" alt=""><figcaption><p>HTTP running on a website</p></figcaption></figure>

<figure><img src="/files/pN11BGaCuWicjLU98397" alt=""><figcaption><p>Evidence and Remediation</p></figcaption></figure>