Konfigurim i Pasigurt i Sigurisë

Security misconfiguration is the OWASP category for any security-relevant setting that is left in an unsafe default or accidentally exposed.

Classic examples: a MongoDB instance bound to 0.0.0.0 with no password, a Jenkins admin panel reachable from the internet with default credentials, debug mode enabled in production (exposing stack traces and database queries), directory listing turned on at the web server level, error pages that reveal framework versions, or cloud storage buckets set to public read. Shodan and internet-wide scanners find thousands of such instances every day. The root cause is almost always speed over rigor: a developer sets up a service for testing, forgets to lock it down, and the test box ends up exposed. In cloud environments, a single mis-scoped IAM policy can make an entire S3 bucket or a database snapshot world-readable. Once indexed by a search engine, private data may spread to archives that are impossible to fully delete. Defense starts with a hardening checklist: change all default credentials, disable unused services, restrict management interfaces to internal networks or VPN, enforce TLS everywhere, disable verbose error messages in production, and run periodic external vulnerability scans (Nessus, OpenVAS, Nuclei). Infrastructure as Code (Terraform, Ansible) helps by making configuration auditable and repeatable.

Mjete:

• Nikto, Nuclei, OWASP ZAP Baseline — skanerë konfiguracioni.
• Gobuster, ffuf, dirsearch — directory brute-force.
• SecurityHeaders.com, HardenThe Web.

Skanimi i konfiguracionit:

nikto -h https://target.test
nuclei -u https://target.test -t exposures/
ffuf -u https://target.test/FUZZ -w /usr/share/wordlists/dirb/common.txt

Heqja e banner-ave në Apache (security.conf):

ServerTokens Prod
ServerSignature Off
TraceEnable Off
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

1. Gjej tre konfigurime të parazgjedhura të rrezikshme (p.sh. panel admin default, phpinfo.php i ekspozuar).
2. Rishkruaj një .htaccess që bllokon aksesin te /admin përveç një IP specifike.

• OWASP A05:2021 — Security Misconfiguration.
• CIS Benchmark — Apache HTTPD / Nginx.
• Mozilla Observatory.