This talk is about a real war story. The intention of the talk is to show beginners in the Penetration testing field, and experienced testers, about the importance of all security findings, even those that we commonly care less about or dismiss due to their lower risk nature. Sometimes low risk findings in a web application can help lead to other vulnerabilities, which in turn might be even more severe and could lead an attacker to compromise an entire application or in some cases an entire enterprise network. The talk will walkthrough and explain a chain of hacks used on a real-world penetration testing engagement which resulted in compromise of an entire corporate network through a simple web application. Along the way we will explain each misconfiguration or mistake made by the target and will show the audience why penetration testing is so valuable to an organization beyond just point-and-click automated vulnerability scanning.