Security Misconfiguration

Check List

Methodology

Black Box

Debug Endpoint Exposed in Production API

1

Access the API without authentication

2

Attempt to discover debug or test endpoints

GET /api/debug HTTP/1.1
Host: target.com

3

If response returns environment variables, stack trace, or configuration data, debug endpoint is exposed

4

Test additional common debug paths

GET /api/test HTTP/1.1
Host: target.com

or

GET /api/v1/status HTTP/1.1
Host: target.com

5

If internal configuration or sensitive metadata is returned, production misconfiguration is confirmed

6

If debug functionality is accessible publicly, Security Misconfiguration vulnerability exists

---

Verbose Error Messages in API

1

Send malformed JSON to an endpoint

POST /api/login HTTP/1.1
Host: target.com
Content-Type: application/json

{"username":"admin","password":}

2

Observe server response, If full stack trace, file path, framework version, or SQL query is disclosed

Exception in file /var/www/app/controllers/AuthController.js line 47

3

Then error handling is misconfigured

4

If internal implementation details are exposed, Security Misconfiguration is confirmed

---

Directory Listing Enabled on API Path

1

Attempt directory access

GET /api/ HTTP/1.1
Host: target.com

2

If response shows directory index listing endpoints or files, directory listing is enabled, Test additional paths

GET /api/v1/ HTTP/1.1
Host: target.com

3

If internal API structure is revealed, configuration hardening is missing

4

If sensitive routes are exposed via directory listing, misconfiguration is confirmed

---

Default Credentials on API Admin Panel

1

Identify administrative API interface

2

Attempt authentication with common default credentials

POST /api/admin/login HTTP/1.1
Host: target.com
Content-Type: application/json

{"username":"admin","password":"admin"}

3

If login succeeds using default or weak credentials, default configuration remains active

4

If administrative access is granted without credential hardening, Security Misconfiguration vulnerability is confirmed

---

CORS Misconfiguration Allowing Arbitrary Origin

1

Send preflight request

OPTIONS /api/user/profile HTTP/1.1
Host: target.com
Origin: https://attacker.com
Access-Control-Request-Method: GET

2

Observe response headers

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

3

If API allows wildcard origin with credentials enabled, cross-origin data access is possible

4

If sensitive API responses are accessible cross-origin due to permissive CORS policy, Security Misconfiguration is confirmed

---

White Box

Cheat Sheet