Defaults Debug and Open Surfaces

Misconfiguration means the running posture differs from the intended secure posture: debug/profiler left on, default accounts unchanged, sample apps deployed, directory listing enabled, unnecessary HTTP methods, overly permissive CORS, cloud buckets public, security headers absent (Lesson 2), frames allowed where they should not be (Lesson 3). Attacker goal: discover and use those gaps without writing a 0-day. Finding language: “Debug endpoint reachable; default credentials accepted; listing enabled.” Fix language: “Hardening checklist; least feature; deny-by-default; remove samples; rotate defaults; headers present.”

sudo apt install curl

SAFE="http://127.0.0.1:8769"

curl -sS -m 3 -I "$SAFE/" | head -n 20

Default passwords, default keys in docs, and frameworks that ship with example admin panels are classic A02. Debug modes leak paths, config, and sometimes secrets in error pages. Attackers try the boring paths first with curl -sS -I: /debug, /.env (should never be web-reachable), /actuator, /phpinfo, server-status. Literacy is recognizing the class — not a wordlist homework against strangers or hydra against a LAN router. On YOUR lab: identify DEMO, then enable a debug banner on 127.0.0.1:8769, then disable it and record before/after. That is the feeling of A02 without leaving your machine.

sudo apt install curl

SAFE="http://127.0.0.1:8769"

for p in / /debug /server-status /actuator /phpinfo; do
curl -sS -m 2 -o /dev/null -w "%{http_code} $p
" "$SAFE$p"
done
curl -sS -m 3 -I "$SAFE/" | grep -i -E "Server:|X-Powered-By:|X-Debug|X-AspNet"

Directory listing turns a forgotten folder into an inventory. Sample apps and leftover staging hosts expand attack surface. Extra services (old admin on a second port) are still in scope for an attacker who finds them. Shipping: turn off listing; remove samples; close ports you do not need; put admin behind auth and network policy YOU control. Cloud: public object storage and open security groups are A02 cousins — only inventory tenants YOU own.

sudo apt install curl

SAFE="http://127.0.0.1:8769"

curl -sS -m 3 -D - "$SAFE/" | head -n 16
curl -sS -m 3 "$SAFE/" | head -n 20
curl -sS -m 3 -o /dev/null -w "listing_try %{http_code}
" "$SAFE/listing"

Checklist mindset: disable debug in production; change defaults; remove unused features; error pages without stack traces to clients; TLS and headers (next lesson); automated config tests. Secrets never in web roots. Patch and rebuild images so “temporary” debug does not linger. Report: describe the exposed surface and impact. Do not dump a stranger’s.env into Discord. Do not hydra the home gateway.

Date (UTC). A02 = Security Misconfiguration (OWASP Top 10:2025). Identify banner of http://192.168.0.1/ or SAFE 127.0.0.1:8769. Defaults/debug/listing one line each. Ship: hardening checklist. Ethics: NEVER scan stranger hosts; NEVER hydra/nmap the LAN. Path: $HOME/cyberlium-lab/a02-defaults-notes.txt, chmod 600. Legal: original Cyberlium — not official OWASP certification.

Create a tiny static server with listing on. Identify DEMO first. HOST 127.0.0.1 only. Two terminals: server + curls.

sudo apt install curl
sudo apt install nmap
sudo apt install python3

brew install nmap
brew install python3

choco install nmap  # or download https://nmap.org/download.html

cd "$HOME/cyberlium-lab"

SAFE="http://127.0.0.1:8769"

cat > a02_listing_demo.py << 'PY'
from http.server import ThreadingHTTPServer, SimpleHTTPRequestHandler
import os

HOST = "127.0.0.1"  # bind only — never 0.0.0.0, never argv
PORT = 8769
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")
os.chdir(os.path.join(os.path.expanduser("~"), "cyberlium-lab", "a02-static"))

class ListingOn(SimpleHTTPRequestHandler):
def end_headers(self):
    self.send_header("X-Debug", "on")
    super().end_headers()

print("bind", HOST, PORT)
print("demo_writeup_url http://192.168.0.1/")
print("if 192.168.0.1 is a router, curl", f"http://{HOST}:{PORT}/")
print("ethics: NEVER scan stranger hosts; NEVER hydra/nmap the LAN")
print("legal: original Cyberlium — not official OWASP certification")
ThreadingHTTPServer((HOST, PORT), ListingOn).serve_forever()
PY

cat > a02_defaults_practical.sh << 'SH'
SAFE="http://127.0.0.1:8769"

curl -sS -D - "$SAFE/" -o /tmp/a02_listing.body | head -n 15
echo; echo "--- body snippet ---"; head -n 20 /tmp/a02_listing.body; echo

curl -sS -I "$SAFE/" | grep -i -E 'X-Debug|HTTP/'

SH

{

You now treat Security Misconfiguration (OWASP Top 10:2025 A02) as insecure defaults, debug, and open surfaces — with identified demo curls and locked local notes. Original Cyberlium — not official OWASP certification. Next — Security Headers and CSP.