Detecting security misconfigurations

Security misconfigurations are relative. In this category, a lot of possible errors are introduced, and the most simple and accurate way to detect them using Burp Suite is through the scanner.

1. Open Burp Suite and when the main Dashboard is displayed, click on New scan. Here it is possible to define the URL to scan, and some options, like credentials to log in to the application, as shown in the following screenshot:

2. The tests are classified by categories. When the scan finishes, we can see that some issues are detected that are related to security misconfiguration, as shown in the following screenshot:

As we can see, there are issues like Unencrypted communications or Clear submission password that we could not detect by analyzing the request, but the scanner marks an issue.

Let's review some common security misconfigurations, which we will look into in detail in the following sections.

Unencrypted communications and clear text protocols

There is a common issue...