Security Misconfiguration (OWASP A05)

Purpose

Provide detection patterns for security misconfiguration vulnerabilities including default credentials, debug mode exposure, missing security headers, and insecure TLS settings.

OWASP Top 10 Mapping

Category: A05 - Security Misconfiguration

CWEs:

• CWE-16: Configuration
• CWE-209: Information Exposure Through Error Messages
• CWE-215: Information Exposure Through Debug Information
• CWE-548: Information Exposure Through Directory Listing
• CWE-756: Missing Custom Error Page

When to Use

Activate this skill when:

• Reviewing application configuration files
• Checking for exposed debug/admin endpoints
• Auditing security header implementation
• Verifying TLS/SSL configuration
• Looking for default or weak credentials

Debug Mode Enabled

Detection Patterns

Python (Django/Flask)

# Django debug mode
grep -rniE "DEBUG\s*=\s*True" --include="*.py" --include="settings.py"

# Flask debug mode
grep -rniE "app\.debug\s*=\s*True|FLASK_DEBUG|debug=True" --include="*.py"

# Environment files
grep -rniE "DEBUG=1|DEBUG=true|DEBUG=True" --include="*.env" --include=".env*"

Java (Spring)

# Spring DevTools / Debug
grep -rniE "spring\.devtools|management\.endpoints\.web\.exposure|actuator" --include="*.properties" --include="*.yaml" --include="*.yml"

# Exposed actuator endpoints
grep -rniE "exposure\.include.*\*|exposure\.include.*health,info,env" --include="*.properties" --include="*.yaml"

PHP

# Display errors
grep -rniE "display_errors.*On|display_errors.*1|error_reporting.*E_ALL" --include="*.php" --include="php.ini"

# Laravel debug
grep -rniE "APP_DEBUG=true|'debug'.*=>.*true" --include="*.env" --include="*.php"

Go

# Gin debug mode
grep -rniE "gin\.SetMode.*gin\.DebugMode|GIN_MODE=debug" --include="*.go" --include="*.env"

# pprof enabled
grep -rniE "net/http/pprof|/debug/pprof" --include="*.go"

TypeScript/Node.js

# Debug environment
grep -rniE "NODE_ENV.*development|DEBUG=\*|debug.*true" --include="*.ts" --include="*.js" --include="*.env"

Default Credentials

Detection Patterns

# Common default passwords
grep -rniE "password.*['\"]admin['\"]|password.*['\"]123456['\"]|password.*['\"]password['\"]|password.*['\"]root['\"]|password.*['\"]test['\"]" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Default usernames with passwords
grep -rniE "admin.*admin|root.*root|user.*password|test.*test" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php" --include="*.env" --include="*.yaml"

# Database defaults
grep -rniE "postgres.*postgres|mysql.*root|mongodb.*admin" --include="*.env" --include="*.yaml" --include="*.properties"

Common Default Credentials to Check

Exposed Admin/Debug Endpoints

Detection Patterns

# Admin routes
grep -rniE "[\"\'/]admin|[\"\'/]_admin|[\"\'/]administrator" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Debug/Dev endpoints
grep -rniE "[\"\'/]debug|[\"\'/]_debug|[\"\'/]dev|[\"\'/]test" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Internal endpoints
grep -rniE "[\"\'/]internal|[\"\'/]private|[\"\'/]system" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Monitoring endpoints
grep -rniE "[\"\'/]metrics|[\"\'/]health|[\"\'/]status|[\"\'/]actuator|[\"\'/]swagger|[\"\'/]graphql" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Framework-Specific Endpoints

Missing Security Headers

Detection Patterns

# Look for header setting code
grep -rniE "Content-Security-Policy|X-Frame-Options|X-Content-Type-Options|Strict-Transport-Security|X-XSS-Protection" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Middleware/interceptor configuration
grep -rniE "helmet|securityHeaders|addHeader|setHeader.*security" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Required Security Headers

TLS/SSL Misconfiguration

Detection Patterns

# Insecure TLS versions
grep -rniE "SSLv2|SSLv3|TLSv1\.0|TLSv1\.1|ssl\.PROTOCOL_SSLv|TLS_RSA_" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Disabled certificate verification
grep -rniE "verify.*false|InsecureSkipVerify.*true|VERIFY_NONE|verify_ssl.*False|rejectUnauthorized.*false" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Weak ciphers
grep -rniE "DES|RC4|MD5|NULL|EXPORT|anon" --include="*.go" --include="*.py" --include="*.java" --include="*.conf"

Secure TLS Configuration

Minimum: TLS 1.2 Recommended: TLS 1.3

Safe cipher suites:

• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256

Directory Listing

Detection Patterns

# Nginx
grep -rniE "autoindex\s+on" --include="*.conf" --include="nginx.conf"

# Apache
grep -rniE "Options.*Indexes|DirectoryIndex" --include="*.conf" --include=".htaccess"

# Application-level
grep -rniE "directory.*listing|listFiles|readdir" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Proxy Cache Misconfiguration

Overview

Proxy caches (Nginx, Varnish, CDN) can expose sensitive data if:

• Authenticated responses are cached based on file extension
• Cache key doesn't include session/auth identifiers
• Dynamic paths are cached as static content

See also: cache-poisoning skill for comprehensive cache attack patterns.

Detection Patterns

# Nginx proxy cache configuration
grep -rniE "proxy_cache|proxy_cache_valid|proxy_cache_key" --include="*.conf" --include="nginx.conf"

# CRITICAL: Cache rules for static extensions on dynamic paths
grep -rniE "location.*\.(css|js|png|jpg|jpeg|gif|ico|svg)" -A10 --include="*.conf" | grep -iE "proxy_cache|cache"

# Missing cache bypass for authenticated requests
grep -rniE "proxy_cache_bypass|proxy_no_cache" --include="*.conf"

# Varnish cache rules
grep -rniE "vcl_recv|vcl_hash|set beresp\.ttl" --include="*.vcl"

Security Checklist

• Authenticated responses excluded from cache (proxy_cache_bypass $http_authorization)
• Cache key includes user identifier for personalized content
• Cache-Control: private set for authenticated endpoints
• Vary: Authorization header used appropriately

CORS Misconfiguration

Detection Patterns

# Wildcard origin
grep -rniE "Access-Control-Allow-Origin.*\*|AllowAllOrigins|cors.*origin.*\*" --include="*.go" --include="*.py" --include="*.java" -