⚙️ WSTG-CONF: Configuration and Deployment Management

OWASP Web Security Testing Guide v4.2

By FixTheVuln Team Sources: OWASP WSTG v4.2
← OWASP WSTG Guide

Secure configuration is a cornerstone of application security, yet it is frequently overlooked. This category tests whether web servers, application platforms, and cloud services are deployed with hardened settings rather than insecure defaults. Misconfiguration issues range from exposed admin interfaces and verbose error messages to missing security headers and overly permissive file permissions. These issues are particularly dangerous because they often require no authentication to exploit and can be found through automated scanning. For security professionals, understanding configuration hardening is essential for both offensive testing and defensive architecture reviews.

Difficulty: Intermediate 11 test cases

OWASP Top 10 Mapping

This testing category relates to the following OWASP Top 10 2021 categories:

A05

Quick Reference

Test ID Name CWEs Difficulty
WSTG-CONF-01Network Infrastructure ConfigCWE-16Intermediate
WSTG-CONF-02Application Platform ConfigCWE-16, CWE-2Intermediate
WSTG-CONF-03File Extensions HandlingCWE-538, CWE-200Intermediate
WSTG-CONF-04Backup and Unreferenced FilesCWE-538, CWE-530Intermediate
WSTG-CONF-05Admin Interface EnumerationCWE-16, CWE-200Intermediate
WSTG-CONF-06HTTP Methods TestingCWE-16Intermediate
WSTG-CONF-07HSTS TestingCWE-319, CWE-16Intermediate
WSTG-CONF-08RIA Cross Domain PolicyCWE-16, CWE-346Intermediate
WSTG-CONF-09File Permissions TestingCWE-732, CWE-276Intermediate
WSTG-CONF-10Subdomain TakeoverCWE-16Intermediate
WSTG-CONF-11Cloud Storage TestingCWE-16, CWE-284Intermediate

Detailed Test Cases

WSTG-CONF-01: Network Infrastructure Config

Intermediate

This test evaluates the security configuration of network infrastructure components including firewalls, routers, load balancers, and DNS servers. It checks for unnecessary open ports, weak access controls, and insecure protocols that could provide an entry point into the environment.

Why it matters: Network infrastructure misconfigurations can bypass application-level security controls entirely. An attacker who finds an open management port or insecure protocol can often gain deeper access than through the web application itself.

What to Check

  • Scan for unnecessary open ports and services on the server
  • Verify that administrative interfaces are not publicly accessible
  • Check for insecure protocols (Telnet, FTP, unencrypted SNMP)
  • Test DNS configuration for zone transfer vulnerabilities
  • Review firewall rules for overly permissive configurations
Tools: Nmap Masscan dig Shodan Nessus
CWE-16

WSTG-CONF-02: Application Platform Config

Intermediate

This test reviews the configuration of application platforms such as web servers, application servers, and database servers. It checks for insecure default settings, unnecessary features, debug modes left enabled, and missing security hardening measures.

Why it matters: Application platforms are often deployed with default configurations optimized for development convenience rather than security. Debug modes, sample applications, and default accounts left in production create easy targets for attackers.

What to Check

  • Check for debug mode or verbose error configuration in production
  • Verify that default or sample applications have been removed
  • Review logging configuration for sensitive data exposure
  • Test that directory listing is disabled on the web server
  • Confirm unnecessary modules and features are disabled
Tools: Nikto Nmap NSE scripts curl Browser Developer Tools testssl.sh
CWE-16 CWE-2

WSTG-CONF-03: File Extensions Handling

Intermediate

This test examines how the web server handles different file extensions, particularly whether it exposes source code or sensitive files when requested with specific extensions. Mishandled extensions can cause the server to serve raw source code instead of executing it.

Why it matters: If a web server serves source code files instead of executing them, attackers can read application logic, database credentials, API keys, and internal comments. This often happens with backup files (.bak, .old) or alternative extensions (.php~, .asp.old).

What to Check

  • Request files with backup extensions (.bak, .old, .orig, .copy, .tmp)
  • Test for source code disclosure using tilde (~) or editor-generated extensions
  • Check if the server handles file extension case sensitivity correctly
  • Look for configuration files accessible through extension manipulation
  • Verify that server-side script extensions are always processed, never served raw
Tools: Burp Suite ffuf Gobuster curl Nikto
CWE-538 CWE-200

WSTG-CONF-04: Backup and Unreferenced Files

Intermediate

This test searches for old backup files, unreferenced pages, and leftover development artifacts on the web server. These files often contain sensitive information, source code, or older versions of the application with known vulnerabilities.

Why it matters: Backup files and unreferenced content frequently contain credentials, configuration details, or outdated code with known security issues. Because these files are not linked from the main application, they often escape security reviews and remain accessible indefinitely.

What to Check

  • Brute-force common backup file patterns (.zip, .tar.gz, .sql, .bak for each known file)
  • Search for version control artifacts (.git, .svn, .hg directories)
  • Look for database dumps and SQL backup files
  • Check for IDE and editor temporary files (.swp, .swo, ~files)
  • Scan for unreferenced administrative or test pages
Tools: Gobuster ffuf Dirsearch Burp Suite Content Discovery GitTools
CWE-538 CWE-530

WSTG-CONF-05: Admin Interface Enumeration

Intermediate

This test identifies administrative interfaces for both infrastructure components and the application itself. Admin panels often provide elevated access and may be protected only by obscurity rather than proper authentication and access controls.

Why it matters: Administrative interfaces are high-value targets because they typically provide full control over the application or infrastructure. When these are exposed with default credentials or weak authentication, they represent a critical risk to the entire system.

What to Check

  • Scan for common admin panel paths (/admin, /administrator, /manage, /console)
  • Check for infrastructure management interfaces (phpMyAdmin, Tomcat Manager, cPanel)
  • Look for admin interfaces on non-standard ports
  • Test discovered admin panels for default credentials
  • Verify that admin interfaces enforce strong authentication and IP restrictions
Tools: Gobuster ffuf Nikto Nmap Burp Suite
CWE-16 CWE-200

WSTG-CONF-06: HTTP Methods Testing

Intermediate

This test checks which HTTP methods the web server accepts and whether dangerous methods like PUT, DELETE, or TRACE are enabled. Unnecessary HTTP methods can allow attackers to upload malicious files, delete content, or perform cross-site tracing attacks.

Why it matters: Enabling unnecessary HTTP methods expands the attack surface without providing value. The TRACE method can be used for cross-site tracing attacks, while PUT and DELETE can allow unauthorized file manipulation if access controls are not properly configured.

What to Check

  • Send an OPTIONS request to enumerate allowed HTTP methods
  • Test if PUT method allows arbitrary file uploads
  • Check if DELETE method can remove files from the server
  • Verify TRACE method is disabled to prevent cross-site tracing (XST)
  • Test for HTTP method override headers (X-HTTP-Method-Override, X-Method-Override)
Tools: curl Burp Suite Nmap http-methods script OWASP ZAP
CWE-16

WSTG-CONF-07: HSTS Testing

Intermediate

This test verifies that HTTP Strict Transport Security (HSTS) is properly implemented to force browsers to only connect via HTTPS. Without HSTS, users may be vulnerable to SSL stripping attacks where an attacker downgrades the connection from HTTPS to HTTP.

Why it matters: HSTS prevents SSL stripping and protocol downgrade attacks by instructing browsers to always use HTTPS. Without it, an attacker on the same network can intercept the initial HTTP request before the redirect to HTTPS and hijack the session.

What to Check

  • Verify the Strict-Transport-Security header is present in HTTPS responses
  • Check that the max-age value is sufficiently long (at least 31536000 seconds / 1 year)
  • Confirm includeSubDomains directive is set if subdomains should also use HTTPS
  • Check if the domain is in the HSTS preload list for maximum protection
  • Test that HTTP requests properly redirect to HTTPS before serving content
Tools: curl testssl.sh SecurityHeaders.com Browser Developer Tools SSL Labs
CWE-319 CWE-16

WSTG-CONF-08: RIA Cross Domain Policy

Intermediate

This test examines cross-domain policy files (crossdomain.xml for Flash and clientaccesspolicy.xml for Silverlight) that control which external domains can interact with the application. Overly permissive policies can allow any domain to make cross-origin requests.

Why it matters: While Flash and Silverlight are largely deprecated, cross-domain policy files may still be present on servers and could be exploited if overly permissive. A wildcard policy allowing all domains effectively disables the same-origin policy for the application.

What to Check

  • Check for the existence of crossdomain.xml in the web root
  • Check for clientaccesspolicy.xml in the web root
  • Verify that policies do not use wildcard (*) domain permissions
  • Ensure policies restrict allowed domains to trusted partners only
  • Confirm that policies specify secure=true for HTTPS-only access
Tools: curl Browser Burp Suite
CWE-16 CWE-346

WSTG-CONF-09: File Permissions Testing

Intermediate

This test reviews file and directory permissions on the web server to ensure sensitive files are not world-readable and that upload directories do not allow script execution. Incorrect permissions can expose configuration files, logs, and credentials.

Why it matters: Improperly configured file permissions can allow unauthorized users to read sensitive configuration files, write malicious content, or execute uploaded scripts. This is especially critical in shared hosting environments where multiple applications run on the same server.

What to Check

  • Verify configuration files are not readable by the web server user
  • Check that log files are not accessible through the web server
  • Ensure upload directories do not have execute permissions
  • Review file ownership to confirm principle of least privilege
  • Test for directory traversal paths that might access restricted files
Tools: ls -la Burp Suite Nikto Custom scripts
CWE-732 CWE-276

WSTG-CONF-10: Subdomain Takeover

Intermediate

Subdomain takeover occurs when a DNS record (usually a CNAME) points to an external service that the organization no longer controls. An attacker can register the abandoned service and serve content under the organization's trusted domain.

Why it matters: Subdomain takeover allows attackers to host malicious content on a trusted domain, which can be used for phishing, cookie theft, or bypassing content security policies. It exploits the trust users and browsers place in the organization's domain.

What to Check

  • Enumerate all subdomains and their DNS records (A, CNAME, MX)
  • Identify CNAME records pointing to external services (AWS, Azure, GitHub Pages, Heroku)
  • Check if the target services return error pages indicating unclaimed resources
  • Verify that decommissioned services have had their DNS records removed
  • Test if you can register the orphaned service endpoint
Tools: Sublist3r Amass dig can-i-take-over-xyz Subjack
CWE-16

WSTG-CONF-11: Cloud Storage Testing

Intermediate

This test checks whether cloud storage services (S3 buckets, Azure Blobs, Google Cloud Storage) associated with the application are securely configured. Misconfigured cloud storage is one of the most common causes of large-scale data breaches.

Why it matters: Cloud storage misconfigurations have caused some of the largest data breaches in history. Publicly readable or writable buckets can expose millions of records, and these misconfigurations can be found through simple enumeration and guessing of bucket names.

What to Check

  • Enumerate cloud storage endpoints from application source code and DNS records
  • Test S3 buckets for public read access (ListBucket, GetObject)
  • Check for public write permissions that could allow data modification
  • Verify that bucket policies and ACLs follow the principle of least privilege
  • Look for cloud storage URLs in JavaScript files, error messages, and metadata
Tools: AWS CLI S3Scanner GCPBucketBrute AzureHound Burp Suite
CWE-16 CWE-284

Relevant Certifications

The following certifications cover configuration and deployment management concepts:

Security+CEHOSCP

Frequently Asked Questions

What are the most common web server misconfigurations that lead to security vulnerabilities?

The most common misconfigurations include default credentials on admin interfaces, directory listing enabled, verbose error messages exposing stack traces, missing security headers (HSTS, CSP, X-Frame-Options), unnecessary HTTP methods enabled (PUT, DELETE, TRACE), and outdated TLS configurations. These issues are easy to find and easy to fix, which is why they appear so frequently in security assessments.

How does WSTG-CONF relate to the OWASP Top 10?

WSTG-CONF maps directly to OWASP Top 10 A05: Security Misconfiguration, which covers missing security hardening, unnecessary features enabled, default accounts, overly informative error messages, and misconfigured security headers. It is consistently one of the most prevalent vulnerability categories found in real-world applications.

What is subdomain takeover and why is it a configuration issue?

Subdomain takeover occurs when a DNS record points to a service (like a cloud hosting platform) that the organization no longer controls. An attacker can claim the orphaned service and serve malicious content under the organization's domain. This is a configuration management issue because it results from failing to clean up DNS records when decommissioning services.

CyberFolio

Mastering web security testing? Showcase your skills.

Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.

Build Your Portfolio →

Related WSTG Categories

WSTG-INFO
Information Gathering WSTG-IDNT
Identity Management WSTG-ATHN
Authentication Testing WSTG-ATHZ
Authorization Testing
← Back to Home ← All WSTG Categories