SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillspentest-config-hardening

pentest-config-hardening

Testing & quality

View repository

Updated 10-15 22:41

About this skill

Pentest Config Hardening

Purpose

Shannon checks only 2 of 14 WSTG-CONF items. The remaining 12 are "low-hanging fruit" findings expected in every professional pentest report — straightforward to test systematically.

Prerequisites

Authorization Requirements

  • Written authorization with infrastructure testing scope
  • Target URL list for all web-facing endpoints
  • CDN/WAF awareness — some headers may be set by infrastructure, not application

Environment Setup

  • testssl.sh for comprehensive TLS analysis
  • nmap with ssl-enum-ciphers script
  • curl for manual header inspection
  • nuclei with misconfig templates

Core Workflow

  1. HTTP Security Headers: Audit HSTS (+ preload), CSP policy analysis, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, CORP/COEP/COOP (WSTG-CONF-07/14).
  2. TLS Configuration: Protocol versions (TLS 1.0/1.1 deprecation), cipher suite strength, certificate validity, HSTS preload status, certificate transparency.
  3. HTTP Method Handling: OPTIONS enumeration, PUT/DELETE on static resources, TRACE for XST, method override headers (WSTG-CONF-06).
  4. Infrastructure Exposure: Admin interfaces (WSTG-CONF-05), default credentials on management consoles, exposed monitoring endpoints (/metrics, /health, /debug).
  5. Cloud Storage Misconfig: Public S3 buckets, Azure blob containers, GCP storage referenced in app code or responses (WSTG-CONF-11).
  6. CSP Bypass Analysis: unsafe-inline, unsafe-eval, overly broad source lists, JSONP on allowed domains, missing base-uri (WSTG-CONF-12).
  7. Cookie Security: Secure flag, HttpOnly flag, SameSite attribute, cookie scope, session cookie entropy.

WSTG Coverage

WSTG ID Test Name Status
WSTG-CONF-02 Test Application Platform Configuration ✅
WSTG-CONF-03 Test File Extensions Handling ✅
WSTG-CONF-04 Review Old Backup and Unreferenced Files ✅
WSTG-CONF-05 Enumerate Infrastructure and Admin Interfaces ✅
WSTG-CONF-06 Test HTTP Methods ✅
WSTG-CONF-07 Test HTTP Strict Transport Security ✅
WSTG-CONF-08 Test RIA Cross Domain Policy ✅
WSTG-CONF-09 Test File Permission ✅
WSTG-CONF-11 Test Cloud Storage ✅
WSTG-CONF-12 Test Content Security Policy ✅
WSTG-CONF-13 Test for Subdomain Takeover ✅
WSTG-CONF-14 Test Security Headers ✅

Tool Categories

Category Tools Purpose
TLS Testing testssl.sh, nmap ssl-enum-ciphers Protocol and cipher analysis
Header Audit SecurityHeaders.com API, Mozilla Observatory Security header grading
Method Testing curl, nmap http-methods HTTP method enumeration
CSP Analysis CSP Evaluator, custom scripts CSP bypass assessment
Cloud Storage S3Scanner, cloud_enum Public bucket detection
Subdomain subjack, can-i-take-over-xyz Subdomain takeover detection

References

  • references/tools.md - Tool function signatures and parameters
  • references/workflows.md - Attack pattern definitions and test vectors