OpenVAPTInformation Exposure and Misconfiguration
How forgotten files, verbose errors and version banners hand attackers the map, and sometimes the keys.
OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/p6.html. Offline: openvapt learn P6.
Read First: P5
You Will Be Able To
- Explain the impact of exposed .git folders, .env files and backups.
- Explain why directory listing, status pages and version disclosure matter.
- Recognise risky PHP and CMS settings.
Forgotten Files
An exposed .git folder lets anyone rebuild your source code and its history, often including committed secrets. A downloadable .env file usually means full compromise. Backups and SQL dumps left in the web root contain whole databases.
Reconnaissance Leaks
Directory listings show every file in a folder. Server status pages show live requests. Version numbers in headers let attackers match you to public exploit lists in seconds. Hiding versions does not fix vulnerabilities, but removes free reconnaissance.
Platform Settings
PHP's display_errors prints internals into pages, and allow_url_include turns a file-inclusion bug into remote code execution. Unsupported PHP versions stop receiving fixes. WordPress version disclosure and an open XML-RPC endpoint invite automated attacks.
In Summary
Exposed .git, .env, backup files and directory listings leak secrets and code. Default pages and version banners help attackers aim. Debug mode must be off in production.
Apply It
These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.
Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Lab
Run: openvapt demo --only WEB-EXP-,WEB-PHP-,WEB-CMS- and read how the evidence is redacted.Find the bodyHas markers in internal/checks/web/exposure.go and explain how they avoid soft-404 false positives.
Check Yourself
Answers are checked in your browser and never stored or sent.
References
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
OpenVAPT. (2026). P6: Information Exposure and Misconfiguration (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p6.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
@misc{openvapt_p6,
author = {{OpenVAPT}},
title = {{P6: Information Exposure and Misconfiguration}},
year = {2026},
howpublished = {\url{https://openvapt.com/academy/p6.html}},
note = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.