--- title: "P6: Information Exposure and Misconfiguration" canonical: https://openvapt.com/academy/p6.html html: https://openvapt.com/academy/p6.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P6: Information Exposure and Misconfiguration How forgotten files, verbose errors and version banners hand attackers the map, and sometimes the keys. - Level: Practitioner - Time: about 25 minutes - Read first: P5 ## You Will Be Able To - Explain the impact of exposed .git folders, .env files and backups. - Explain why directory listing, status pages and version disclosure matter. - Recognise risky PHP and CMS settings. ## Forgotten Files An exposed .git folder lets anyone rebuild your source code and its history, often including committed secrets. A downloadable .env file usually means full compromise. Backups and SQL dumps left in the web root contain whole databases. ## Reconnaissance Leaks Directory listings show every file in a folder. Server status pages show live requests. Version numbers in headers let attackers match you to public exploit lists in seconds. Hiding versions does not fix vulnerabilities, but removes free reconnaissance. ## Platform Settings PHP's display_errors prints internals into pages, and allow_url_include turns a file-inclusion bug into remote code execution. Unsupported PHP versions stop receiving fixes. WordPress version disclosure and an open XML-RPC endpoint invite automated attacks. ## In Summary Exposed .git, .env, backup files and directory listings leak secrets and code. Default pages and version banners help attackers aim. Debug mode must be off in production. ## Apply It - [WEB-CMS-001 WordPress Version Disclosed](https://openvapt.com/checks/WEB-CMS-001.md) (low) - [WEB-CMS-002 WordPress XML-RPC Interface Enabled](https://openvapt.com/checks/WEB-CMS-002.md) (low) - [WEB-CMS-003 WordPress User Accounts Enumerable](https://openvapt.com/checks/WEB-CMS-003.md) (low) - [WEB-CMS-004 CMS Configuration Readable by All Users](https://openvapt.com/checks/WEB-CMS-004.md) (high) - [WEB-CMS-005 CMS Configuration Writable by Other Users](https://openvapt.com/checks/WEB-CMS-005.md) (high) - [WEB-CMS-006 WordPress Shows Debug Output to Visitors](https://openvapt.com/checks/WEB-CMS-006.md) (medium) - [WEB-CMS-007 WordPress Dashboard File Editor Enabled](https://openvapt.com/checks/WEB-CMS-007.md) (low) - [WEB-CMS-008 WordPress Automatic Updates Disabled](https://openvapt.com/checks/WEB-CMS-008.md) (medium) - [WEB-CMS-009 Joomla Debug or Verbose Error Reporting Enabled](https://openvapt.com/checks/WEB-CMS-009.md) (medium) - [WEB-CMS-010 Joomla Version Disclosed](https://openvapt.com/checks/WEB-CMS-010.md) (low) - [WEB-CMS-011 Drupal Version Disclosed by Changelog](https://openvapt.com/checks/WEB-CMS-011.md) (low) - [WEB-CMS-012 Drupal Core Past End of Life](https://openvapt.com/checks/WEB-CMS-012.md) (high) - [WEB-CMS-013 Drupal Trusted Host Patterns Not Set](https://openvapt.com/checks/WEB-CMS-013.md) (medium) - [WEB-CMS-014 Joomla Core Past End of Life](https://openvapt.com/checks/WEB-CMS-014.md) (high) - [WEB-CMS-015 Magento Not in Production Mode](https://openvapt.com/checks/WEB-CMS-015.md) (medium) - [WEB-CMS-016 Ghost Configured With a Plain HTTP Site URL](https://openvapt.com/checks/WEB-CMS-016.md) (medium) - [WEB-CMS-017 WordPress Cron Reachable by Visitors](https://openvapt.com/checks/WEB-CMS-017.md) (info) - [WEB-CMS-018 WordPress Author Archive Reveals Login Names](https://openvapt.com/checks/WEB-CMS-018.md) (low) - [WEB-CMS-019 Drupal update.php Open Without Authentication](https://openvapt.com/checks/WEB-CMS-019.md) (high) - [WEB-DOC-001 Secrets or Backups Stored Inside a Web Root](https://openvapt.com/checks/WEB-DOC-001.md) (high) - [WEB-DOC-002 Web Root Files Writable by Other Users](https://openvapt.com/checks/WEB-DOC-002.md) (high) - [WEB-DOC-003 Archives or Certificates Inside a Web Root](https://openvapt.com/checks/WEB-DOC-003.md) (medium) - [WEB-EXP-001 Git Repository Exposed on the Website](https://openvapt.com/checks/WEB-EXP-001.md) (high) - [WEB-EXP-002 Environment or Secrets File Exposed](https://openvapt.com/checks/WEB-EXP-002.md) (critical) - [WEB-EXP-003 PHP Information Page Exposed](https://openvapt.com/checks/WEB-EXP-003.md) (medium) - [WEB-EXP-004 Backup or Database Dump Files Downloadable](https://openvapt.com/checks/WEB-EXP-004.md) (high) - [WEB-EXP-005 Directory Listing Enabled](https://openvapt.com/checks/WEB-EXP-005.md) (medium) - [WEB-EXP-006 Web Server Status Page Exposed](https://openvapt.com/checks/WEB-EXP-006.md) (medium) - [WEB-EXP-007 Other Version Control Metadata Exposed](https://openvapt.com/checks/WEB-EXP-007.md) (high) - [WEB-EXP-008 Log Files Downloadable From the Website](https://openvapt.com/checks/WEB-EXP-008.md) (high) - [WEB-EXP-009 Dependency Manifests Exposed](https://openvapt.com/checks/WEB-EXP-009.md) (low) - [WEB-EXP-010 Default Web Server Page Served](https://openvapt.com/checks/WEB-EXP-010.md) (low) - [WEB-EXP-011 Database Administration Tool Exposed](https://openvapt.com/checks/WEB-EXP-011.md) (medium) - [WEB-EXP-012 Framework Debug Pages Exposed](https://openvapt.com/checks/WEB-EXP-012.md) (high) - [WEB-HDR-007 Server Software Version Disclosed](https://openvapt.com/checks/WEB-HDR-007.md) (low) - [WEB-PHP-001 PHP Displays Errors to Visitors](https://openvapt.com/checks/WEB-PHP-001.md) (medium) - [WEB-PHP-002 PHP Version Exposed in Headers](https://openvapt.com/checks/WEB-PHP-002.md) (low) - [WEB-PHP-003 PHP Allows Remote File Inclusion](https://openvapt.com/checks/WEB-PHP-003.md) (high) - [WEB-PHP-004 PHP Version Past End of Security Support](https://openvapt.com/checks/WEB-PHP-004.md) (high) - [WEB-PHP-005 PHP Session Cookies Not Hardened](https://openvapt.com/checks/WEB-PHP-005.md) (medium) ## Lab 1. `Run: openvapt demo --only WEB-EXP-,WEB-PHP-,WEB-CMS- and read how the evidence is redacted.` 2. `Find the bodyHas markers in internal/checks/web/exposure.go and explain how they avoid soft-404 false positives.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Why is an exposed .git folder serious? - A. It slows the site - B. Anyone can rebuild the source code and history, including secrets - C. It breaks HTTPS - D. It only reveals the folder name - Answer: B. The history often contains credentials committed by mistake. 2. What should you do after finding an exposed .env file? - A. Delete it only - B. Block it, remove it and rotate every secret in it - C. Rename it - D. Set its permissions to 600 and keep the same secrets - Answer: B. Treat every secret in it as leaked. Hiding the file now does not undo earlier downloads. 3. Why does OpenVAPT require content markers, not just HTTP 200? - A. To avoid false positives from sites that return 200 for every path - B. To save bandwidth - C. Because 200 means error - D. Because real files never return 200 - Answer: A. Soft-404 pages return 200 for any path and would otherwise trigger every check. 4. What can PHP's allow_url_include turn a file-inclusion bug into? - A. A harmless warning - B. Remote code execution - C. A denial of service only - D. A cookie leak only - Answer: B. With allow_url_include on, an inclusion bug can load and run code from another server. 5. Does hiding version numbers fix vulnerabilities? - A. Yes, attackers cannot attack what they cannot identify - B. No, it removes free reconnaissance but patching is what fixes them - C. Yes, if the Server header is removed too - D. No, and versions should always be shown - Answer: B. Hiding versions removes a free hint. The vulnerable code is still there until it is patched. 6. A database dump named backup.sql sits in the web root. What is the main risk? - A. It uses disk space - B. Anyone who finds it can download the whole database - C. It slows the database down - D. It breaks HTTPS - Answer: B. Backups and SQL dumps in the web root contain whole databases that anyone can fetch. ## Key Terms - Information Disclosure: Exposing information, such as versions, paths or secrets, that helps an attacker. - Security Misconfiguration: A weakness caused by insecure settings rather than a software bug. - Directory Listing: A web server feature that shows every file in a folder when there is no index page. - Secrets Management: Keeping passwords, keys and tokens out of code and public places, and rotating them safely. ## References - [OWASP Top 10 2021, A05 Security Misconfiguration](https://top10.owasp.org/2021/A05_2021-Security_Misconfiguration/) - [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) Offline: `openvapt learn P6`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p6.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.