Skip to main content

Configuration Alerts

Open Directory (opendir)

What is it?

A web server misconfiguration that allows visitors to browse directory contents (e.g., /files/) instead of being restricted to specific web pages.

WhereHow is it detected?

    Nimbusec

  • searches

    Detectedfor duringfile vulnerabilitydirectory scans,listing penetrationwhen tests,visiting or manual browsing of URL paths.webpage.

  • Commonly flagged by tools like those of Nimbusec.

Alert level:

    YELLOW

  • YELLOW–– Can expose sensitive files and aid in targeted attacks.

  • Disable directory listing.

  • Store sensitive files outside web-accessible directories.

  • Conduct regular audits of file paths exposed to the internet.

PHP Error Display

What is it?

When PHP error messages are displayed directly in the browser instead of being hidden and logged securely.

WhereHow is it detected?

    Nimbusec

  • searches

    Detectedfor duringphp penetrationerror tests,message vulnerabilitywhen scans,visiting or by simply triggering errors on the site (e.g., malformed requests).webpage.

Alert level:

    YELLOW

  • YELLOW–– Reveals internal system details (file paths, queries, API keys) that attackers can exploit.

  • Disable display_errors in production environments.

  • Log errors to a secure server or file instead of displaying them publicly.

  • Implement custom error pages for users.

  • Regularly review logs for abnormal or repeated errors.

Public Config

What is it?

Files,Apache databases,status or storage resourcespages are accidentallychecked configuredfor aspublic “public,” making them accessibleaccess without authentication.

WhereHow is it detected?

    Nimbusec

  • checks

    Detected/server-info during/server-status cloudfor securitypublic audits, vulnerability scans, or penetration tests.accessibility

  • Common with cloud storage (e.g., AWS S3, Azure Blob, Google Cloud Storage).

Alert level:

    YELLOW

  • YELLOW–– OftenReveals leadsinternal system details, which can lead to large-scaledifferent dataattack leaks and breaches.
vectors.

  • Apply “private by default” permissions to all storage resources.

  • Review access controls regularly (especially in cloud environments).

  • Use encryption and authentication for all sensitive files.

  • Enable monitoring for unauthorized public access changes.

Security Header Config

What is it?

Missing or misconfigured HTTP response headers that strengthen browser-level protections against attacks.

Occures when SHR grade is lowernlower than "D".

WhereHow is it detected?

    Nimbusec

  • Detectedcalculates usinga automatedgrade toolsfrom suchA asto thoseF for the Security Headers of Nimbusecscanned ordomains penetrationbased testing.
    • on
  • Mozilla Observatory.

    Common headers include CSP, HSTS, X-Frame-Options, and X-Content-Type-Options.

Alert level:

  • YELLOW–YELLOW – Increases exposure to XSS, clickjacking, and MITM attacks.
  • Add and properly configure key security headers.
  • Follow OWASP Secure Headers Project guidelines.
  • Regularly test site headers with automated tools.
  • Review headers after web server or app updates.


For more information, please check the following article:
https://blog.projectdiscovery.io/guide-to-dns-takeovers/ 

Back to top