The authoritative source for the definition, misconfiguration categories, example attack scenarios (CORS misconfiguration, verbose error messages, unnecessary HTTP methods), and prevention guidance in this module. CWE references: CWE-2 (Environmental Security Flaws), CWE-16 (Configuration), CWE-388 (Error Handling). This course is an independent study companion — not affiliated with or endorsed by OWASP.

RedLock security researchers discovered Tesla’s Kubernetes admin dashboard exposed to the public internet with no authentication. The dashboard showed environment variables including AWS credentials across multiple pods. Attackers had already found the open dashboard and deployed a Monero cryptomining container configured to use minimal CPU and route through a proxy to avoid detection. Tesla was alerted and patched the misconfiguration the same day. The incident was part of a broader RedLock Cloud Security Intelligence Report that found similar Kubernetes misconfigurations at other organizations. Referenced in slides 1, 11, 24, 26. Primary source: RedLock CSI Report, February 2018.

Appthority researchers analyzed 2,705 iOS and Android apps using Firebase Realtime Database. They found 2,446 apps (over 90%) with databases configured using open read/write rules — Firebase’s default at the time — allowing anyone to read and write without authentication. The exposed data included approximately 2.6 million plaintext passwords, 4 million+ PHI records, 25 million GPS location records, 50,000 financial records, and 4.5 million social media tokens. Approximately 100 million records total. Firebase changed their default security rules in 2019 to require authentication. Referenced in slides 13, 26. Primary source: Appthority HospitalGown Threat Report, September 2018.

Seminal research on CORS misconfiguration exploitation, demonstrating reflected-origin vulnerabilities at scale across major websites including banks, UK government sites, and major tech companies. Describes the null origin bypass, subdomain trust misuse, and pre-flight exploitation patterns. Forms the technical basis for the CORS content in slides 4, 10, 14, 19. The research introduced automated CORS misconfiguration scanning and showed these issues were widespread across high-value targets.

Free tool that analyzes HTTP security headers and grades API/web application security configuration. Tests for HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and CORS configuration. Provides actionable recommendations. Referenced in MIT 03 (slide 21) and MIT 07 (slide 25) as an automated scanning tool for CI/CD integration.

Official Spring Boot documentation on securing Actuator endpoints. Covers enabling authentication, restricting exposed endpoints to only health and metrics, and disabling heapdump and env endpoints in production. Relevant to the admin endpoint mechanics in slide 12 and MIT 06 (slide 24). Multiple real-world breaches have occurred through exposed Actuator heapdump endpoints leaking secrets from JVM heap memory.

Tool generating production-ready TLS configurations for nginx, Apache, HAProxy, and other servers. Produces configurations that disable deprecated TLS versions (1.0, 1.1) and weak cipher suites while maintaining compatibility with current browsers. Referenced in MIT 05 (slide 23) as the recommended starting point for TLS configuration.

Complete reference for HTTP security response headers: what each header does, recommended values, browser support, and implementation guidance. Covers HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin headers. Directly informs MIT 03 (slide 21).

Free, comprehensive TLS configuration analysis that grades protocol versions, cipher suites, certificate validity, and known vulnerabilities. Produces an A–F grade with specific remediation recommendations. Run against any public HTTPS API endpoint. Referenced in MIT 05 (slide 23).

Interactive CORS labs covering: basic reflected-origin exploitation, null-origin bypass, trusted subdomain exploitation, and CORS with internal networks. Recommended hands-on practice for the CORS content in this module (slides 4, 10, 14, 19).