📋 What Is It?
Security Misconfiguration - Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.
#6
OWASP Rank 2017
9%
Apps Tested
215K
Occurrences
⚠️ Common Exploits
- Default Credentials: Use factory passwords
- Directory Listing: Browse server directories
- Verbose Errors: Extract system information
- Unnecessary Features: Exploit unused services
- Missing Security Headers: Launch attacks
🔴 Attack Flow
1. Attacker scans for common misconfigurations
↓
2. Finds default admin credentials or open ports
↓
3. Accesses administrative interface
↓
4. Exploits misconfigured services
↓
5. BREACH: System compromised!
↓
2. Finds default admin credentials or open ports
↓
3. Accesses administrative interface
↓
4. Exploits misconfigured services
↓
5. BREACH: System compromised!
✓ Prevention Checklist
- Implement secure installation processes
- Remove or disable unused features and frameworks
- Review and update configurations regularly
- Implement security headers (CSP, HSTS, etc.)
- Use automated configuration scanning tools
📌 Quick Reference
Risk Level: HIGH RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #6 in 2017