# Web-server config misconfiguration pre-scan

- target: `sample-repo`
- config files scanned: 6
- findings: HIGH 10 · MEDIUM 27 · LOW 13 · INFO 1

_Deterministic pre-scan — not an audit. Directive- and block-level; include-file indirection is followed only inside the scanned tree. A clean report is not proof the vhost is safe._


## HIGH

- `sample-repo/apache/hostile-httpd.conf:7` **AP-OPEN-PROXY** — ProxyRequests On — forward proxy open to abuse (scan/relay for anyone)
- `sample-repo/apache/hostile-httpd.conf:13` **AP-OVERRIDE** — AllowOverride All — .htaccess can re-enable handlers/options the server config did not intend
- `sample-repo/apache/hostile-httpd.conf:14` **AP-REQUIRE-ALL** — world-readable grant ('Require all granted'/'Allow from all') on a filesystem-root block — whole disk servable
- `sample-repo/apache/hostile-httpd.conf:18` **AP-CGI** — Options ExecCGI — script execution in this directory under an upload/writable-looking path
- `sample-repo/apache/hostile-httpd.conf:19` **AP-CGI** — cgi-script handler bound — any file here executes under an upload/writable-looking path
- `sample-repo/apache/hostile-httpd.conf:32` **AP-DAV** — WebDAV enabled — write methods over HTTP
- `sample-repo/nginx/hostile-nginx.conf:16` **NG-ALIAS-TRAV** — alias/location trailing-slash parity break — '/loc../x' requests resolve outside the alias root (CVE-class misconfig)
- `sample-repo/nginx/hostile-nginx.conf:20` **NG-ALIAS-TRAV** — alias inside a regex location — the matched suffix is attacker-shaped; classic path-traversal shape
- `sample-repo/nginx/hostile-nginx.conf:28` **NG-SATISFY-ANY** — satisfy any inside a block that also carries auth/allow/deny vocabulary — one satisfied condition bypasses the rest
- `sample-repo/nginx/hostile-nginx.conf:38` **NG-DAV** — dav_methods PUT/DELETE/MKCOL/COPY/MOVE — HTTP write methods enabled

## MEDIUM

- `sample-repo/apache/hardened-httpd.conf:29` **AP-DAV** — WebDAV enabled — write methods over HTTP (auth guard present)
- `sample-repo/apache/hostile-httpd.conf:4` **AP-TRACE** — TraceEnable On — TRACE echoes request headers (XST class)
- `sample-repo/apache/hostile-httpd.conf:8` **AP-SSL-WEAK** — SSLProtocol permits SSLv3/TLSv1/TLSv1.1 (or 'all' without explicit -TLSv1/-SSLv3)
- `sample-repo/apache/hostile-httpd.conf:9` **AP-SSL-WEAK** — SSLCipherSuite lists weak tokens (EXPORT/NULL/RC4/DES/MD5)
- `sample-repo/apache/hostile-httpd.conf:12` **AP-OPTIONS-ALL** — Options All grants Indexes + ExecCGI + Includes + MultiViews together
- `sample-repo/apache/hostile-httpd.conf:18` **AP-INDEXES** — Options Indexes — directory listing enabled
- `sample-repo/apache/hostile-httpd.conf:20` **AP-OVERRIDE** — AllowOverride All — .htaccess can re-enable handlers/options the server config did not intend
- `sample-repo/apache/hostile-httpd.conf:24` **AP-STATUS** — status/handler endpoint exposed — leaks config, vhosts, child processes
- `sample-repo/apache/hostile-httpd.conf:28` **AP-STATUS** — status/handler endpoint exposed — leaks config, vhosts, child processes
- `sample-repo/apache/hostile-httpd.conf:36` **AP-SSI** — Options Includes — SSI enabled with #exec allowed
- `sample-repo/apache/hostile-httpd.conf:41` **AP-CORS-WILD** — Access-Control-Allow-Origin: * set in config — verify the vhost never serves credentialed content
- `sample-repo/nginx/hardened-nginx.conf:30` **NG-DAV** — dav_methods PUT/DELETE — HTTP write methods enabled (auth/internal guard present)
- `sample-repo/nginx/hostile-nginx.conf:4` **NG-HDR-SMUGGLE** — underscores_in_headers on / ignore_invalid_headers off — header-name ambiguity is a request-smuggling surface
- `sample-repo/nginx/hostile-nginx.conf:11` **NG-SSL-WEAK** — ssl_protocols enables TLSv1/TLSv1.1/SSLv3 — deprecated transport
- `sample-repo/nginx/hostile-nginx.conf:12` **NG-SSL-WEAK** — ssl_ciphers lists weak tokens (EXPORT/NULL/RC4/DES/MD5)
- `sample-repo/nginx/hostile-nginx.conf:13` **NG-SSI** — ssi on — server-side includes enabled; SSI directives in user-reachable content execute #exec/#include
- `sample-repo/nginx/hostile-nginx.conf:24` **NG-AUTOINDEX** — autoindex on — directory listing exposed
- `sample-repo/nginx/hostile-nginx.conf:34` **NG-STATUS** — stub_status exposed — connection/request metrics leak
- `sample-repo/nginx/hostile-nginx.conf:42` **NG-REDIRECT-VAR** — return/rewrite target built from a client-controlled variable — open-redirect shape
- `sample-repo/nginx/hostile-nginx.conf:46` **NG-PROXY-VAR** — proxy_pass with a variable upstream — the target is attacker/request-shaped; SSRF-shaped unless validated upstream
- `sample-repo/nginx/hostile-nginx.conf:50` **NG-HDR-SPOOF** — identity header (X-Real-IP/X-Forwarded-*) set from the client's OWN header — IP/host spoofing reaches the upstream
- `sample-repo/nginx/hostile-nginx.conf:51` **NG-HEADER-REFLECT** — response header set from a client-controlled $http_/$arg_/$cookie_ variable — header reflection / splitting surface
- `sample-repo/nginx/hostile-nginx.conf:52` **NG-CORS-WILD** — Access-Control-Allow-Origin: * set in config — verify this block never serves credentialed/session content
- `sample-repo/uploads/.htaccess:1` **AP-HTACCESS-PHP** — php_flag engine/display_errors on in .htaccess — upload-dir PHP-exec / debug-leak shape
- `sample-repo/uploads/.htaccess:2` **AP-HTACCESS-PHP** — php_flag engine/display_errors on in .htaccess — upload-dir PHP-exec / debug-leak shape
- `sample-repo/uploads/.htaccess:3` **AP-HTACCESS-PHP** — PHP/CGI handler bound in .htaccess — file-upload-to-exec shape
- `sample-repo/uploads/.htaccess:4` **AP-INDEXES** — Options Indexes — directory listing enabled

## LOW

- `sample-repo/apache/hardened-httpd.conf:19` **AP-REQUIRE-ALL** — world-readable grant ('Require all granted'/'Allow from all') — standard on a public docroot; review if the block holds private content
- `sample-repo/apache/hardened-httpd.conf:23` **AP-STATUS** — status/handler endpoint exposed — leaks config, vhosts, child processes (guarded)
- `sample-repo/apache/hostile-httpd.conf:2` **AP-TOKENS** — ServerTokens Full — exact version/module banner to clients
- `sample-repo/apache/hostile-httpd.conf:3` **AP-TOKENS** — ServerSignature On — version footer on generated pages
- `sample-repo/apache/hostile-httpd.conf:5` **AP-LOGLEVEL** — LogLevel debug/trace — request data (auth headers, cookies) lands in logs
- `sample-repo/apache/hostile-httpd.conf:6` **AP-USERDIR** — UserDir enabled — per-user ~dirs servable; legacy enumeration/PHP-risk surface
- `sample-repo/apache/hostile-httpd.conf:36` **AP-MULTIVIEWS** — Options MultiViews — content negotiation turns /x into /x.php; file-name confusion surface
- `sample-repo/apache/hostile-httpd.conf:38` **AP-REQUIRE-ALL** — world-readable grant ('Require all granted'/'Allow from all') — standard on a public docroot; review if the block holds private content
- `sample-repo/apache/hostile-httpd.conf:42` **AP-PROXY-INTERNAL** — ProxyPass to an internal/loopback target — normal fronting pattern; note it reaches an internal service from outside
- `sample-repo/nginx/hardened-nginx.conf:21` **NG-AUTOINDEX** — autoindex on — directory listing exposed (auth/internal guard present)
- `sample-repo/nginx/hardened-nginx.conf:25` **NG-STATUS** — stub_status exposed — connection/request metrics leak (guarded)
- `sample-repo/nginx/hostile-nginx.conf:5` **NG-MERGE-SLASHES** — merge_slashes off — // sequences not normalized; path-matching gaps vs upstream
- `sample-repo/nginx/hostile-nginx.conf:6` **NG-BODY-SIZE** — client_max_body_size >= 50m — large upload DoS surface

## INFO

- `sample-repo/nginx/hostile-nginx.conf:56` **NG-IF-LOC** — if (…) inside a location — 'if is evil' in nginx; rewrite/return inside if is the only safe pattern