I85PREP
⌘ K
CWICP study materials
CWICP study resources

CWICP: Server Configuration, Hosting, and Infrastructure

CWICP · Work through your exam, one topic at a time.

All guide sections

Server Configuration, Hosting, and Infrastructure

This domain tests whether you notice the layers around the application: web server defaults, exposed files, management interfaces, cloud storage, and the metadata services that turn a small SSRF into infrastructure compromise. Many findings here are found by requesting paths that should not exist.

What to check

  • Default and management surfaces. Default credentials on admin consoles, /server-status, /phpinfo.php, Jenkins, Kibana, Grafana, phpMyAdmin, Tomcat manager, Spring Actuator endpoints (/actuator/env, /actuator/heapdump).
  • Exposed artifacts. .git/HEAD, .svn/, .DS_Store, .env, web.config, backup.zip, index.php~, db.sql, source maps (.js.map). /.git/ with directory listing lets you reconstruct full source and its history, including deleted secrets.
  • Directory listing and methods. Autoindex reveals backups; OPTIONS reveals allowed verbs; PUT/TRACE/DELETE enabled on static servers is a misconfiguration finding.
  • Debug and verbosity. Stack traces, framework debug pages, Server/X-Powered-By version disclosure that matches a known CVE.
  • Cloud storage. S3 bucket ACLs and policies (public list vs public read are different permissions), Azure blob containers, GCS. Naming conventions make buckets guessable.
  • Instance metadata. http://169.254.169.254/latest/meta-data/iam/security-credentials/ (IMDSv1 reachable via SSRF); IMDSv2 requires a token. GCP and Azure have equivalents.
  • Container and orchestration. Unauthenticated Docker API on 2375, Kubernetes API anonymous auth, exposed etcd, Redis and Elasticsearch without auth, CI/CD runners holding deployment secrets.

Worked example

GET /.git/HEAD returns ref: refs/heads/main with 200. Reasoning: the repository is served statically; with directory listing enabled you can mirror it and run history analysis. Recover config.php from an older commit containing database credentials, then verify whether that credential is live before reporting - an old credential that no longer authenticates is informational, not critical. If it is live, the finding is source disclosure plus credential exposure, and the fix is to remove the directory from the document root and rotate the secret.

Traps that cost marks

  • Reporting a bucket as public when only object-level reads work; test listing separately.
  • Trusting a banner version as the running version on a patched distro build.
  • Missing non-obvious paths (.env.bak, /.well-known/, /api/swagger.json, /graphql introspection).
  • Forgetting that metadata credentials are temporary but often long-lived enough to pivot.