Fail Open Authentication and Parameter Injection

["Indian Tiger" <indiantiger () mailandnews com>]

Hi,

I am learning Web Application Security Penetration Testing using WebGoat. I
have some queries on this.

Fail Open Authentication
WebGoat's step 3 says: "Try removing password parameter with Achilles. "
How it's possible. Is there any chance when server don't even check password
if we remove password parameter.

Parameter Injection
What could be the scenario where a site is vulnerable to Parameter
Injections.
I have given a thought on this but not able to think how exactly it works in
practice.
Webgoat has given an example like this 'blah & netstat -a & ipconfig'
But where a developer will be allowing to insert such values.

Any help on this would be highly appriciated.


Thanking You.
Sincerely,

Indian Tiger, CISSP