wstg-configuration-management

Follow the OWASP WSTG-CONF methodology: map the infrastructure, check for known vulnerabilities and default credentials, enumerate admin interfaces, test HTTP methods, and validate security headers like HSTS. Each test case includes objectives, procedures, and remediation steps.

Append backup extensions like .bak, .old, .orig, ~, .tmp, and .swp to known filenames, check for directory listing, review robots.txt, and query search engine caches. Backup files often disclose source code, database credentials, and configuration details.

Subdomain takeover occurs when DNS records point to unclaimed or deprovisioned services. Enumerate DNS records, identify dangling CNAME or A records returning NXDOMAIN or 404 responses, and verify whether the service provider allows claiming the resource without ownership verification.

Yes, WSTG-CONF-11 covers cloud storage testing. It includes identifying storage URLs in client-side code, testing unauthenticated read, write, and delete access, and reviewing S3 bucket policies, ACLs, and public access blocks.

TRACE reflects request headers back in the response body. Combined with cross-site scripting, it enables cross-site tracing (XST) attacks that steal HttpOnly cookies and Authorization tokens. Servers should disable TRACE and all unneeded HTTP methods.

A secure HSTS setup sends Strict-Transport-Security with max-age of at least 31536000 (one year), includes includeSubDomains when subdomains exist, and is sent only on HTTPS responses. Two years with the preload directive enables browser preload list submission.