Technique
№ 026 · class: discovery
Configuration Abuse
Configuration abuse involves exploiting misconfigured systems, services, or security controls. Attackers look for default passwords, overly broad permissions, open ports, and services without authentication.
Term
description · examples · notesConfiguration abuse involves exploiting misconfigured systems, services, or security controls. Attackers look for default passwords, overly broad permissions, open ports, and services without authentication.
Description
Misconfiguration is one of the most common causes of security breaches. Unlike code vulnerabilities, configuration errors are often environment-specific and difficult to discover through automated scanning.
Examples
- Accessing a database exposed to the internet without authentication
- Exploiting overly broad permissions on a cloud storage bucket allowing public access
- Using default admin credentials on a network device
Notes
- Regular configuration audits and applying security baselines reduce the risk.
Threats
used by 9Threats that use it. Select one to open its page.
Defenses
countered by 11How it is countered. Select one to open its page.