0
Back to scan results
Check 4 of 45

Insecure Server Configuration

A focused review of common web-server configuration mistakes: ASP.NET remote debugging, accepted TRACE requests, overly specific software banners, and directory listings exposed to the internet. Check 42 separately performs the deeper WebDAV and HTTP-method review.

What this check probes

  • ASP.NET DEBUG method — independently tests HTTP port 80 and HTTPS port 443 using DEBUG with Command: stop-debug. A failure requires the exact ASP.NET 200 OK response plus three differing control responses; an ordinary page or catch-all route returning “OK” is not enough.
  • TRACE method — sends a TRACE request and reviews the response. Accepted TRACE requests require review; check 42 separately inspects advertised HTTP and WebDAV methods.
  • Server banner — inspects the Server response header. nginx alone is fine; nginx/1.18.0 (Ubuntu) is information leakage that helps an attacker target known CVEs.
  • X-Powered-By — same idea: X-Powered-By: PHP/7.2.10 tells an attacker exactly which CVEs to try.
  • Directory listing — requests known directory paths and looks for "Index of /" markup, which means autoindex is enabled and attackers can browse your filesystem.

Why this matters for PCI DSS

PCI DSS 4.0 Requirement 2.2 mandates that system components are configured securely and that all unnecessary services and functions are removed or disabled. Requirement 2.2.5 specifically calls out that "if any insecure services, protocols, or daemons are present" they must be justified, documented, and have additional security features enabled.

Remove unnecessary exposure, minimize implementation detail, and document any server behavior that must remain enabled for a legitimate business purpose.

How to fix it

Apache — in your main config:

TraceEnable Off
ServerTokens Prod
ServerSignature Off
<Directory /var/www/html>
    Options -Indexes
</Directory>

nginx — TRACE is not enabled by default. To strip the version from the banner:

http {
    server_tokens off;
    autoindex off;
}

ASP.NET / IIS — compile production applications with debugging disabled, disable unnecessary TRACE handling, and remove detailed server banners:

<system.web>
  <compilation debug="false" />
</system.web>
<system.webServer>
  <security>
    <requestFiltering>
      <verbs allowUnlisted="true">
        <add verb="TRACE" allowed="false" />
        <add verb="OPTIONS" allowed="true" />
      </verbs>
    </requestFiltering>
  </security>
  <security><requestFiltering removeServerHeader="true" /></security>
</system.webServer>

For X-Powered-By in PHP, edit php.ini: expose_php = Off. In ASP.NET, remove the header in web.config via <httpProtocol><customHeaders><remove name="X-Powered-By" />.

Verify ASP.NET DEBUG handling with curl -i -X DEBUG -H "Command: stop-debug" https://example.com/; a production application must not return a two-character OK body with HTTP 200. Verify TRACE handling with curl -i -X TRACE https://example.com/. Review check 42 for separate WebDAV and method-allowlisting guidance.

Fixed it? Re-run the scan to confirm.

Run scan again