Security misconfiguration is what is left when the application code is correct but the deployment (the process of publishing and running the application on a live server — the computer and software that receives requests from users over the internet and sends them back responses) is sloppy. It sits at position A05:2021 in the OWASP Top 10 — a consensus list published by the Open Web Application Security Project (an international nonprofit) that ranks the ten most critical web application security risks by how commonly they appear in real applications and how much damage they cause. A05 is the fifth entry in the 2021 edition of that list. This category catches deployment mistakes such as default credentials, exposed backup files, verbose error pages, and directories that the web server is willing to list.
In this lesson you will:
- Use FTP Explorer to inspect a simulated exposed directory listing.
- Identify a backup file that should never have been deployed to a production web server.
- Recognize default credentials and verbose errors as the same class of finding.
Estimated time: 10 to 15 minutes.
Hands-on environment: the custom Security Misconfiguration Lab supplies every directory, file, credential, and error example. No running NovaCart instance or login is required.
Course position: this is the first deployment-surface lesson. Later content discovery, scanner triage, component-risk, and hardening lessons will return to these exposed-file signals with more tooling.
When you are ready, send the Continue signal.