A5:2021 Security Misconfiguration
Below we document the steps to test the OWASP A5:2021 Security Misconfiguration security risk only. Use this test to:
- Identify WebDAV attacks
- Identify common/default credentials present
Please note that you can combine tests and run more than one on a specific target or set of targets.
-
On the Risk Types dialogs of the Wizard, select A5 - Security Misconfiguration and any extra options.
Look for known security misconfiguration issues: ????
Look for WebDAV vulnerabilities: Check this option if you want the test to locate pages that have WebDAV vulnerabilities. If found, Core Impact will create a WebDAV agent which represents the knowledge of how to exploit a poorly configured web server.
Look for default host credentials: Check this option if you want the test to locate pages that use default usernames and passwords.
Look for XML External Entities: Identify XML External Entities vulnerabilities affecting different programming languages, libraries and methods such as Java 1.8+, Python, PHP 5, PHP 7 and ASP.
-
Click Next until you are past the Risk Types selection. For the following steps ONLY A5 - Security Misconfiguration and its related options are selected.
If you selected Look for Sensitive Information in documents, this dialog displays to configure.
You can instruct Core Impact to Search for credit card numbers or Search for social security numbers in any documents it finds.
Additionally, add a Custom Search Pattern to help Core Impact find specific data - enter an extended regular expression and that would be run across all the HTML pages that the wizard is targeting.
Check the Apply search filters inside Microsoft Office, OpenOffice and PDF Documents option if you want the test to search inside of documents that are linked from the HTML pages.
Check the Save documents matching search filters option if you want Core Impact to save any documents where it locates sensitive data. Then provide a path where the documents should be saved.
Press Next to continue.
-
The final dialog—Session Management—displays.
To configure a module to avoid testing pages that could terminate the session, use the ellipsis (
) button. By default, the Session arguments avoid list module will be enabled for this purpose. Click the Clear button if you do not want any module to perform this function. -
Click the Finish button to begin the test.
If the WebApps Attack and Penetration is successful, then a new XXE Agent will appear under vulnerable pages in the Entity View. See Interacting with WebApps Agents for information about how to leverage the WebApps Agents.
Return to WebApps Attack and Penetration.