1---2name: pentest-config-hardening3description: Security header auditing, TLS configuration testing, HTTP method analysis, CSP bypass assessment, and deployment hardening verification.4---56# Pentest Config Hardening78## Purpose9Shannon checks only 2 of 14 WSTG-CONF items. The remaining 12 are "low-hanging fruit" findings expected in every professional pentest report — straightforward to test systematically.1011## Prerequisites1213### Authorization Requirements14- **Written authorization** with infrastructure testing scope15- **Target URL list** for all web-facing endpoints16- **CDN/WAF awareness** — some headers may be set by infrastructure, not application1718### Environment Setup19- testssl.sh for comprehensive TLS analysis20- nmap with ssl-enum-ciphers script21- curl for manual header inspection22- nuclei with misconfig templates2324## Core Workflow251. **HTTP Security Headers**: Audit HSTS (+ preload), CSP policy analysis, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, CORP/COEP/COOP (WSTG-CONF-07/14).262. **TLS Configuration**: Protocol versions (TLS 1.0/1.1 deprecation), cipher suite strength, certificate validity, HSTS preload status, certificate transparency.273. **HTTP Method Handling**: OPTIONS enumeration, PUT/DELETE on static resources, TRACE for XST, method override headers (WSTG-CONF-06).284. **Infrastructure Exposure**: Admin interfaces (WSTG-CONF-05), default credentials on management consoles, exposed monitoring endpoints (/metrics, /health, /debug).295. **Cloud Storage Misconfig**: Public S3 buckets, Azure blob containers, GCP storage referenced in app code or responses (WSTG-CONF-11).306. **CSP Bypass Analysis**: unsafe-inline, unsafe-eval, overly broad source lists, JSONP on allowed domains, missing base-uri (WSTG-CONF-12).317. **Cookie Security**: Secure flag, HttpOnly flag, SameSite attribute, cookie scope, session cookie entropy.3233## WSTG Coverage3435| WSTG ID | Test Name | Status |36|---------|-----------|--------|37| WSTG-CONF-02 | Test Application Platform Configuration | ✅ |38| WSTG-CONF-03 | Test File Extensions Handling | ✅ |39| WSTG-CONF-04 | Review Old Backup and Unreferenced Files | ✅ |40| WSTG-CONF-05 | Enumerate Infrastructure and Admin Interfaces | ✅ |41| WSTG-CONF-06 | Test HTTP Methods | ✅ |42| WSTG-CONF-07 | Test HTTP Strict Transport Security | ✅ |43| WSTG-CONF-08 | Test RIA Cross Domain Policy | ✅ |44| WSTG-CONF-09 | Test File Permission | ✅ |45| WSTG-CONF-11 | Test Cloud Storage | ✅ |46| WSTG-CONF-12 | Test Content Security Policy | ✅ |47| WSTG-CONF-13 | Test for Subdomain Takeover | ✅ |48| WSTG-CONF-14 | Test Security Headers | ✅ |4950## Tool Categories5152| Category | Tools | Purpose |53|----------|-------|---------|54| TLS Testing | testssl.sh, nmap ssl-enum-ciphers | Protocol and cipher analysis |55| Header Audit | SecurityHeaders.com API, Mozilla Observatory | Security header grading |56| Method Testing | curl, nmap http-methods | HTTP method enumeration |57| CSP Analysis | CSP Evaluator, custom scripts | CSP bypass assessment |58| Cloud Storage | S3Scanner, cloud_enum | Public bucket detection |59| Subdomain | subjack, can-i-take-over-xyz | Subdomain takeover detection |6061## References62- `references/tools.md` - Tool function signatures and parameters63- `references/workflows.md` - Attack pattern definitions and test vectors
jd-opensource