Beginner LevelWeb Security & Cyber Defense
What is Security Misconfiguration and why are default credentials dangerous?
❓ Interview Prompt: Explain Security Misconfiguration (#5 OWASP risk), default admin credentials, directory listing, public S3 buckets, and hardening guidelines.
Security Misconfiguration occurs when security controls are incorrectly configured, left at default settings, or left un-hardened:
Common Misconfigurations:
1
Default Credentials: Leaving default passwords on database admin tools (e.g. 'admin / admin' on RabbitMQ or ElasticSearch).
2
Public Cloud Storage: Publicly readable AWS S3 buckets containing database backups.
3
Enabled Debug Features: Leaving Django/Express debug error pages enabled in production.
4
Directory Listing: Allowing web servers to display directory file indexes.
Code Implementation Example
json
// Hardened NGINX config fragment:
// autoindex off; # Disables directory file listing
// server_tokens off; # Hides NGINX version string in Server header💡Hardening web server configuration settings.
🎯 Interview Key Takeaway
Harden production configurations by changing default passwords, disabling directory listing, and hiding framework version headers.
#Misconfiguration#Hardening#OWASP#Beginner
Back to all Web Security & Cyber Defense Questions→