Fail Open Authentication and Parameter Injection

Hi,

I am learning Web Application Security Penetration Testing using WebGoat. I have some queries on this.

Fail Open Authentication
WebGoat's step 3 says: "Try removing password parameter with Achilles. " How it's possible. Is there any chance when server don't even check password if we remove password parameter.

Parameter Injection
What could be the scenario where a site is vulnerable to Parameter Injections.
I have given a thought on this but not able to think how exactly it works in practice.
Webgoat has given an example like this 'blah & netstat -a & ipconfig' But where a developer will be allowing to insert such values.

Any help on this would be highly appriciated.

Thanking You.
Sincerely,

Indian Tiger, CISSP Received on Mon Mar 24 13:48:46 2003