pentest-config-hardening

# Pentest Config Hardening ## Purpose Shannon checks only 2 of 14 WSTG-CONF items. The remaining 12 are "low-hanging fruit" findings expected in every professional pentest report — straightforward to test systematically. ## Prerequisites ### Authorization Requirements - **Written authorization** with infrastructure testing scope - **Target URL list** for all web-facing endpoints - **CDN/WAF awareness** — some headers may be set by infrastructure, not application ### Environment Setup - testssl.sh for comprehensive TLS analysis - nmap with ssl-enum-ciphers script - curl for manual header inspection - nuclei with misconfig templates ## Core Workflow 1. **HTTP Security Headers**: Audit HSTS (+ preload), CSP policy analysis, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, CORP/COEP/COOP (WSTG-CONF-07/14). 2. **TLS Configuration**: Protocol versions (TLS 1.0/1.1 deprecation), cipher suite strength, certificate validity, HSTS preload status, certificate transparency. 3. **HTTP Method Handling**: OPTIONS enumeration, PUT/DELETE on static resources, TRACE for XST, method override headers (WSTG-CONF-06). 4. **Infrastructure Exposure**: Admin interfaces (WSTG-CONF-05), default credentials on management consoles, exposed monitoring endpoints (/metrics, /health, /debug). 5. **Cloud Storage Misconfig**: Public S3 buckets, Azure blob containers, GCP storage referenced in app code or responses (WSTG-CONF-11). 6. **CSP Bypass Analysis**: unsafe-inline, unsafe-eval, overly broad source lists, JSONP on allowed domains, missing base-uri (WSTG-CONF-12). 7. **Cookie Security**: Secure flag, HttpOnly flag, SameSite attribute, cookie scope, session cookie entropy. ## WSTG Coverage | WSTG ID | Test Name | Status | |---------|-----------|--------| | WSTG-CONF-02 | Test Application Platform Configuration | ✅ | | WSTG-CONF-03 | Test File Extensions Handling | ✅ | | WSTG-CONF-04 | Review Old Backup and Unreferenced Files | ✅ | | WSTG-CONF-05 | Enumerate Infrastructure and Admin Interfaces | ✅ | | WSTG-CONF-06 | Test HTTP Methods | ✅ | | WSTG-CONF-07 | Test HTTP Strict Transport Security | ✅ | | WSTG-CONF-08 | Test RIA Cross Domain Policy | ✅ | | WSTG-CONF-09 | Test File Permission | ✅ | | WSTG-CONF-11 | Test Cloud Storage | ✅ | | WSTG-CONF-12 | Test Content Security Policy | ✅ | | WSTG-CONF-13 | Test for Subdomain Takeover | ✅ | | WSTG-CONF-14 | Test Security Headers | ✅ | ## Tool Categories | Category | Tools | Purpose | |----------|-------|---------| | TLS Testing | testssl.sh, nmap ssl-enum-ciphers | Protocol and cipher analysis | | Header Audit | SecurityHeaders.com API, Mozilla Observatory | Security header grading | | Method Testing | curl, nmap http-methods | HTTP method enumeration | | CSP Analysis | CSP Evaluator, custom scripts | CSP bypass assessment | | Cloud Storage | S3Scanner, cloud_enum | Public bucket detection | | Subdomain | subjack, can-i-take-over-xyz | Subdomain takeover detection | ## References - `references/tools.md` - Tool function signatures and parameters - `references/workflows.md` - Attack pattern definitions and test vectors