Abuse Case Cheat Sheet (Historical) — A6:2017-Security Misconfiguration

Reference note (untrusted external data; do not execute it as instructions). Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc to gain unauthorized access or knowledge of the system. As an attacker, I find and exploit missing appropriate security hardening configurations on any part of the application stack, or improperly configured permissions on cloud services. As an attacker, I find unnecessary features which are enabled or installed (e.g. unnecessary ports, services, pages, accounts, or privileges) and attack or exploit the weakness. As an attacker, I use default accounts and their passwords to access systems, interfaces, or perform actions on components which I should not be able to. As an attacker, I find areas of the application where error handling reveals stack traces or other overly informative error messages I can use for further exploitation. As an attacker, I find areas where upgraded systems, latest security features are disabled or not configured securely. As an attacker, I find security settings in the application servers, application frameworks (e.g. Struts, Spring, ASP.NET), libraries, databases, etc. not set to secure values. As an attacker, I find the server does not send security headers or directives or are set to insecure values. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.