Back to Cheat Sheets

🛡️ Security MisconfigurationOWASP 2017

OWASP WEB Top 10 2017 - #6

HIGH RISK

📋 What Is It?

Security Misconfiguration - Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.

#6 OWASP Rank 2017
9% Apps Tested
215K Occurrences

⚠️ Common Exploits

  • Default Credentials: Use factory passwords
  • Directory Listing: Browse server directories
  • Verbose Errors: Extract system information
  • Unnecessary Features: Exploit unused services
  • Missing Security Headers: Launch attacks

🔴 Attack Flow

1. Attacker scans for common misconfigurations

2. Finds default admin credentials or open ports

3. Accesses administrative interface

4. Exploits misconfigured services

5. BREACH: System compromised!

✓ Prevention Checklist

  • Implement secure installation processes
  • Remove or disable unused features and frameworks
  • Review and update configurations regularly
  • Implement security headers (CSP, HSTS, etc.)
  • Use automated configuration scanning tools

📌 Quick Reference

Risk Level: HIGH RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #6 in 2017