For Teachers · Back to the Module · Print with your browser's Print command.

P6 Teacher Answer Key: Information Exposure and Misconfiguration

Teacher Answer Key (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P5

Learning Objectives

• [ ] Explain the impact of exposed .git folders, .env files and backups.
• [ ] Explain why directory listing, status pages and version disclosure matter.
• [ ] Recognise risky PHP and CMS settings.

Key Terms

Write each definition in your own words.

• Information Disclosure: Exposing information, such as versions, paths or secrets, that helps an attacker.
• Security Misconfiguration: A weakness caused by insecure settings rather than a software bug.
• Directory Listing: A web server feature that shows every file in a folder when there is no index page.
• Secrets Management: Keeping passwords, keys and tokens out of code and public places, and rotating them safely.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only WEB-EXP-,WEB-PHP-,WEB-CMS- and read how the evidence is redacted.
2. Find the bodyHas markers in internal/checks/web/exposure.go and explain how they avoid soft-404 false positives.

Self-Check Questions

1. Why is an exposed .git folder serious?

• [ ] a) It slows the site
• [x] b) Anyone can rebuild the source code and history, including secrets
• [ ] c) It breaks HTTPS
• [ ] d) It only reveals the folder name
• Answer: b. The history often contains credentials committed by mistake.

1. What should you do after finding an exposed .env file?

• [ ] a) Delete it only
• [x] b) Block it, remove it and rotate every secret in it
• [ ] c) Rename it
• [ ] d) Set its permissions to 600 and keep the same secrets
• Answer: b. Treat every secret in it as leaked. Hiding the file now does not undo earlier downloads.

1. Why does OpenVAPT require content markers, not just HTTP 200?

• [x] a) To avoid false positives from sites that return 200 for every path
• [ ] b) To save bandwidth
• [ ] c) Because 200 means error
• [ ] d) Because real files never return 200
• Answer: a. Soft-404 pages return 200 for any path and would otherwise trigger every check.

1. What can PHP's allow_url_include turn a file-inclusion bug into?

• [ ] a) A harmless warning
• [x] b) Remote code execution
• [ ] c) A denial of service only
• [ ] d) A cookie leak only
• Answer: b. With allow_url_include on, an inclusion bug can load and run code from another server.

1. Does hiding version numbers fix vulnerabilities?

• [ ] a) Yes, attackers cannot attack what they cannot identify
• [x] b) No, it removes free reconnaissance but patching is what fixes them
• [ ] c) Yes, if the Server header is removed too
• [ ] d) No, and versions should always be shown
• Answer: b. Hiding versions removes a free hint. The vulnerable code is still there until it is patched.

1. A database dump named backup.sql sits in the web root. What is the main risk?

• [ ] a) It uses disk space
• [x] b) Anyone who finds it can download the whole database
• [ ] c) It slows the database down
• [ ] d) It breaks HTTPS
• Answer: b. Backups and SQL dumps in the web root contain whole databases that anyone can fetch.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Top 10 2021, A05 Security Misconfiguration: https://top10.owasp.org/2021/A05_2021-Security_Misconfiguration/
• OWASP Secrets Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.