wstg-recon-config

name	wstg-recon-config
description	WSTG reconnaissance, configuration, error handling, and cryptography testing techniques
tags	["recon","config","headers","tls","wstg"]
version	1.0

Recon & Configuration Testing (WSTG-INFO + CONF + ERRH + CRYP)

Google Dork Templates

Replace TARGET with the actual domain:

site:TARGET filetype:pdf | filetype:doc | filetype:xls
site:TARGET inurl:admin | inurl:login | inurl:dashboard
site:TARGET ext:php inurl:?
site:TARGET intitle:"index of"
site:TARGET inurl:wp-content | inurl:wp-includes
site:TARGET ext:log | ext:cfg | ext:env | ext:ini | ext:bak
site:TARGET "error" | "warning" | "fatal" | "exception"
inurl:"q=" site:TARGET
"TARGET" site:pastebin.com | site:github.com | site:trello.com

Directory & File Discovery

ffuf Commands

# Directory brute force
ffuf -u https://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -ac

# File discovery
ffuf -u https://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt -mc 200,301,302 -ac

# Extension fuzzing
ffuf -u https://TARGET/indexFUZZ -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt -mc 200

# Virtual host discovery
ffuf -u https://TARGET -H "Host: FUZZ.TARGET" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -ac

# Parameter discovery
ffuf -u "https://TARGET/page?FUZZ=test" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -mc 200 -ac

Backup File Patterns

Test for these at discovered paths:

.bak, .old, .orig, .save, .swp, .swo, ~
.git/, .svn/, .hg/, .env, .DS_Store
config.php.bak, web.config.old, .htaccess.bak
wp-config.php.bak, database.yml.old
Copy of *, backup-*, archive-*

Security Header Checklist

Check with curl -I https://TARGET:

Header	Expected Value	Risk if Missing
Strict-Transport-Security	max-age=31536000; includeSubDomains	MITM, SSL stripping
Content-Security-Policy	No unsafe-inline, no unsafe-eval	XSS
X-Content-Type-Options	nosniff	MIME sniffing
X-Frame-Options	DENY or SAMEORIGIN	Clickjacking
Referrer-Policy	strict-origin-when-cross-origin	Info leakage
Permissions-Policy	Restrict camera, microphone, geolocation	Feature abuse
X-XSS-Protection	0 (deprecated, CSP preferred)	N/A
Cache-Control	no-store on sensitive pages	Cached credentials

TLS/SSL Testing

# testssl.sh (comprehensive)
testssl.sh --severity HIGH https://TARGET

# sslscan (quick)
sslscan --no-failed TARGET:443

# Check specific issues
# SSLv2/SSLv3 support
openssl s_client -connect TARGET:443 -ssl3 2>&1 | grep -i "alert"

# Certificate details
openssl s_client -connect TARGET:443 </dev/null 2>/dev/null | openssl x509 -text -noout

# Check for HSTS preload
curl -sI https://TARGET | grep -i strict-transport

TLS Issues to Check:

• SSLv3, TLS 1.0, TLS 1.1 supported (should be disabled)
• Weak ciphers (RC4, DES, 3DES, NULL, EXPORT)
• Missing Perfect Forward Secrecy (PFS)
• Certificate: expired, self-signed, wrong CN/SAN, weak signature (SHA1)
• BEAST, POODLE, Heartbleed, CRIME, BREACH, ROBOT

HTTP Methods Testing

# Check allowed methods
curl -X OPTIONS https://TARGET/ -I

# Test dangerous methods
curl -X TRACE https://TARGET/ -I
curl -X PUT https://TARGET/test.txt -d "test" -I
curl -X DELETE https://TARGET/test.txt -I

# Method override headers
curl -X POST https://TARGET/admin -H "X-HTTP-Method-Override: PUT"
curl -X POST https://TARGET/admin -H "X-Method-Override: DELETE"

Error Triggering Payloads

Force errors to check for information disclosure:

# Non-existent pages
curl -s https://TARGET/nonexistent-page-12345

# Invalid parameters
curl -s "https://TARGET/page?id='"
curl -s "https://TARGET/page?id=-1"
curl -s "https://TARGET/page?id=99999999"

# Large input
curl -s "https://TARGET/page?id=$(python3 -c 'print("A"*10000)')"

# Special characters
curl -s "https://TARGET/page?id=%00%0a%0d"

# Content-type mismatch
curl -s -X POST https://TARGET/api/endpoint -H "Content-Type: application/xml" -d "<test>"

Look for in error responses: stack traces, file paths, database names, framework versions, SQL error messages, internal IP addresses.

Subdomain & Cloud Storage

# Subdomain enumeration
subfinder -d TARGET -silent | tee subs.txt
cat subs.txt | httpx -silent -status-code -title | tee live.txt

# Subdomain takeover check
subjack -w subs.txt -t 100 -o takeover.txt

# Cloud storage checks
# AWS S3
aws s3 ls s3://TARGET --no-sign-request 2>/dev/null
aws s3 ls s3://TARGET-backup --no-sign-request 2>/dev/null
aws s3 ls s3://TARGET-assets --no-sign-request 2>/dev/null

# Azure Blob
curl -s "https://TARGET.blob.core.windows.net/\$root?restype=container&comp=list"

# GCS
curl -s "https://storage.googleapis.com/TARGET"

For detailed procedures on any test, read: knowledge/web-application/WSTG-INFO/WSTG-INFO-{NN}.md knowledge/web-application/WSTG-CONF/WSTG-CONF-{NN}.md knowledge/web-application/WSTG-ERRH/WSTG-ERRH-{NN}.md knowledge/web-application/WSTG-CRYP/WSTG-CRYP-{NN}.md