Skip to main content

Configuration Alerts

Open Directory (opendir)

What is it?

A web server misconfiguration that allows visitors to browse directory contents (e.g., /files/) instead of being restricted to specific web pages.

WhereHow is it detected?

    Nimbusec

    searches

    Detectedfor duringfile vulnerabilitydirectory scans,listing penetrationwhen tests,visiting or manual browsing of URL paths.webpage.

    Commonly flagged by tools like those of Nimbusec.

    Alert level:

      YELLOW

      YELLOW–– Can expose sensitive files and aid in targeted attacks.

      • Disable directory listing.

      • Store sensitive files outside web-accessible directories.

      • Conduct regular audits of file paths exposed to the internet.

      PHP Error Display

      What is it?

      When PHP error messages are displayed directly in the browser instead of being hidden and logged securely.

      WhereHow is it detected?

        Nimbusec

        searches

        Detectedfor duringphp penetrationerror tests,message vulnerabilitywhen scans,visiting or by simply triggering errors on the site (e.g., malformed requests).webpage.

        Alert level:

          YELLOW

          YELLOW–– Reveals internal system details (file paths, queries, API keys) that attackers can exploit.

          • Disable display_errors in production environments.

          • Log errors to a secure server or file instead of displaying them publicly.

          • Implement custom error pages for users.

          • Regularly review logs for abnormal or repeated errors.

          Public Config

          What is it?

          Files,Apache databases,status or storage resourcespages are accidentallychecked configuredfor aspublic “public,” making them accessibleaccess without authentication.

          WhereHow is it detected?

            Nimbusec

            checks

            Detected/server-info during/server-status cloudfor securitypublic audits, vulnerability scans, or penetration tests.accessibility

            Common with cloud storage (e.g., AWS S3, Azure Blob, Google Cloud Storage).

            Alert level:

              YELLOW

              YELLOW–– OftenReveals leadsinternal system details, which can lead to large-scaledifferent dataattack leaks and breaches. vectors.

              • Apply “private by default” permissions to all storage resources.

              • Review access controls regularly (especially in cloud environments).

              Use encryption and authentication for all sensitive files.

              Enable monitoring for unauthorized public access changes.

              Security Header Config

              What is it?

              Missing or misconfigured HTTP response headers that strengthen browser-level protections against attacks.

              Occures when SHR grade is lowernlower than "D".

              WhereHow is it detected?

                Nimbusec

                Detectedcalculates usinga automatedgrade toolsfrom suchA asto thoseF for the Security Headers of Nimbusecscanned ordomains penetrationbased testing.on Mozilla Observatory.

                Common headers include CSP, HSTS, X-Frame-Options, and X-Content-Type-Options.

                Alert level:

                • YELLOW–YELLOW – Increases exposure to XSS, clickjacking, and MITM attacks.
                • Add and properly configure key security headers.
                • Follow OWASP Secure Headers Project guidelines.
                • Regularly test site headers with automated tools.
                Review headers after web server or app updates.


                For more information, please check the following article:
                https://blog.projectdiscovery.io/guide-to-dns-takeovers/