Top 5: Security Misconfiguration

What is the consequence of misconfigured HTTP headers?

• Enhanced browser compatibility

• Improved server performance

• Reduced security, leading to various attacks such as XSS and clickjacking.

• Faster loading times

Which misconfiguration can potentially expose internal IP addresses and server details?

• Secure HTTP headers

• Proper CORS configuration

• Directory listing misconfiguration

• Strong password policies

To prevent security misconfigurations the developer should:

• Use default credentials

• Not expose server versions

• Whitelist domains/subdomains

• Disable insecure HTTP methods

Which of the following misconfigurations can result in sensitive data exposure? (Select all that apply)

• Failing to implement Cross-Origin Resource Sharing (CORS) policies.

• Leaving debug mode enabled in production environments.

• Not encrypting data at rest.

• Weak SSL/TLS configuration

• Allowing unnecessary HTTP methods like TRACE and OPTIONS.

PUT method can be used by an attacker:

• Download sensitive information from the application

• Upload files to the application

• Delete files from the application

• None of the above

What is the purpose of a Content Security Policy (CSP) header?

• It controls the server's access to client resources.

• It prevents clickjacking attacks and code injections by restricting the sources from which certain content can be loaded.

• It encrypts sensitive data transmitted between the server and the client.

• It ensures secure user authentication and authorization.

What security vulnerability is mitigated by using HTTP Strict Transport Security (HSTS) headers?

• Cross-Site Scripting (XSS) attacks.

• Man-in-the-Middle (MitM) attacks.

• Session Fixation attacks.

• Clickjacking attacks.

In a web application, the administrator accidentally sets overly permissive file permissions for a configuration file (e.g., 777). What security misconfiguration is this an example of?

• SQL Injection

• Insecure Deserialization

• Insecure File Permissions

• Cross-Site Scripting (XSS)

Which HTTP header helps prevent content sniffing attacks by instructing the browser on how to interpret the content type?

• Content-Type

• Mime-Type

• Content-Disposition

• X-Content-Type-Options

Which of the following misconfigurations can lead to Clickjacking attacks? (Select all that apply)

• Lack of input validation.

• Inadequate session management.

• Insufficient Content Security Policy (CSP) configuration.

• Absence of X-Frame-Options header.

• Weak password policies.