Lesson 5.9: Security misconfiguration and exposed secrets
Not every breach needs a bug in the code. Often the server simply hands things out: an .env file with passwords, a .git folder with the source and its history, a directory listing with a backup, a phpinfo page, debug mode left on. These are exactly what the scanner in lesson 1.3 was probing for. In the lab the shop has all of them. You download them like an attacker would, remove the debug page, stop nginx from serving hidden files and listing folders, test, reload and prove it, and learn why every exposed secret must now be replaced.
19 min
You will learn to
- Recognise common misconfigurations: exposed .env and .git, directory listing, debug pages
- Explain why a leaked secret must be rotated
- Block hidden files and listings in nginx
- Remove debug and test files from production
- Verify several URLs at once with a loop
Key terms
- Security misconfiguration
- An insecure setting rather than a code bug: defaults left on, unneeded features enabled, files exposed, errors shown.
- .env file
- A file with configuration and secrets as NAME=value lines, read by many frameworks at startup.
- Web root
- The folder the web server serves files from.
- Directory listing
- The server shows the files of a folder that has no index page.
- Secret rotation
- Replacing a password, key or token with a new one and revoking the old one.
← Capstone: hardening a server before go-live · All lessons · Capstone: a cryptography health check →