$ cat owasp/a02.md

A02:2025

Security Misconfiguration

The code is fine. The server, framework or cloud settings around it are not.

## 1 · why it happens

Defaults are built for getting started, not for production: debug mode on, sample pages installed, directory listing enabled, verbose errors, every HTTP method allowed.

This is the category OSINT finds best, because misconfiguration is visible from outside: an exposed .git folder, a staging server on a forgotten subdomain, a Swagger page, a version banner. XXE also lives here - it is an XML parser with dangerous features left on.

const app = express();
app.use(express.static('.'));          // serves .git, .env, everything
app.use((err, req, res, next) => {
  res.status(500).send(err.stack);     // stack trace to the world
});

const app = express();
app.disable('x-powered-by');
app.use(helmet());                      // sane security headers
app.use(express.static('public', { dotfiles: 'deny' }));
app.use((err, req, res, next) => {
  logger.error(err);
  res.status(500).json({ error: 'Internal error' });
});

var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Parse,   // enables XXE
    XmlResolver = new XmlUrlResolver()
};
// and in Program.cs:
app.UseDeveloperExceptionPage();           // in production

var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null
};
// Program.cs
if (app.Environment.IsDevelopment())
    app.UseDeveloperExceptionPage();
else
    app.UseExceptionHandler("/error");

## 2 · how attackers find it from outside

→ all OSINT sources · run them on yourself

## 3 · how it's abused

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.

GET /.git/HEAD

GET /.env

GET /swagger/index.html

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>

Payload examples adapted from PayloadsAllTheThings (MIT, © Swissky). Full lists:Insecure Source Code Management · Insecure Management Interface · XXE Injection · Web Cache Deception · Reverse Proxy Misconfigurations

## 4 · fix

• Same hardened config for every environment - staging gets attacked too.
• Turn off debug mode, directory listing, sample apps and unused HTTP methods.
• Remove version headers (server_tokens off, disable X-Powered-By).
• Disable DTDs / external entities in every XML parser.
• Keep an inventory of your subdomains and delete the ones you no longer use.

## 5 · detect

Official description: OWASP A02:2025 Security Misconfiguration