Security Misconfiguration Review

This guide treats web server, framework, proxy, runtime, and deployment configuration as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Map edge, proxy, application server, framework, runtime, and management layers.

2. 02

   Capture headers, redirects, error behavior, and exposed metadata.

3. 03

   Compare production-like and lower-environment configuration intentionally.

4. 04

   Identify ownership for defaults, templates, and policy exceptions.

curl -sS -D - -o /dev/null https://example.com/

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Check security headers and cookie policy against application needs.

2. 02

   Trigger benign validation errors and confirm diagnostics are not exposed.

3. 03

   Verify documentation, health, metrics, and administrative surfaces require intended access.

4. 04

   Review sample, backup, source-map, and default content exposure.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Inventory configuration drift and public management endpoints.
• Monitor debug-mode changes, new routes, and policy exceptions.
• Scan artifacts before deployment for environment-specific secrets and diagnostics.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Use hardened templates and secure defaults.
• Separate public health signals from sensitive diagnostics.
• Remove unused components, samples, and management listeners.
• Continuously compare deployed configuration with policy.