Special functions of a web application or web service are often reserved for certain user groups. The corresponding users then receive user accounts that are exclusively equipped with the necessary access rights (for example). Using these accounts, the users authenticate themselves to the web application or service (e.g. with a user name and password) at the beginning of each session. If this authentication is not configured correctly, it may be possible for an attacker to bypass it. In addition, a web application or web service can be configured in such a way that access data will be stored insecurely on the web server. In the event of a successful incursion, an attacker will then be able to obtain large amounts of access data that can be used elsewhere.