Does it find `.env` and `.git/config`?

No. Leftover config files, logs, and VCS credential files are [Scan for Sensitive Files](/library/modules/scan-for-sensitive-files). This module looks at setup state (is the instance initialized, is the API exposed), not at file exposures.

Does it test network services?

No. Anonymous FTP and exposed auth on a port are [Scan Network Services for Misconfigurations](/library/modules/scan-network-services-for-misconfigurations), which takes `port-details`. This module takes a URL list and probes web setup.

Is a finding exploitable?

Not by itself. Response validation cuts garbage rows. A public Swagger API is info until you confirm what it exposes. An uninitialized GitLab row is a default-state takeover candidate, not a write-up you ship without triage.

Is this a nikto checklist?

No. nikto is a fixed scanner you run from a shell. This is a nestable URL-list subgraph with response validation and recursive path prefixes. For the binary, see [/tools/nikto](/tools/nikto). Do not treat that tool page as this job.

Does it scan nested paths under the origin?

Only if you seed them. A root-only URL list misses nested misconfigs. v1.2.0 added recursive scanning at every level of the input URL path; use it, and know recursion explodes request counts. Feed deeper URLs from crawling or directory brute force when the misconfig lives under a prefix.

Is a finding exploitable?

Not by itself. Response validation cuts garbage rows but cannot certify a finding is exploitable. A public Swagger API is info until you confirm what it exposes. An uninitialized GitLab row is a default-state takeover candidate, not a write-up you ship without triage.

2026-08-13

Vulnerability Scanning

Scan for Misconfigured Software

Scan URLs for web misconfigurations: exposed APIs, debug surfaces, default-state takeover. Response-validated. Not CVE matching, not config files.

What Scan for Misconfigured Software does

Web misconfiguration scanning asks whether an instance is still in a default or unsafe setup state: an API left public, a debug surface left on, an uninitialized app a visitor can finish installing and take over. This module probes a URL list for those setup issues and validates responses to cut false positives. It is not CVE matching and not leftover config file hunting.

You feed a URL list. This module probes live URLs for web misconfigurations: setup disclosure, exposed APIs, debug surfaces, and default-state takeover such as an uninitialized GitLab or a public Swagger API. It validates responses to cut false positives. The question is whether setup is still default, not whether a CVE matcher fired.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Pipeline guidance

Upstream: live URLs from Probe for Web Servers. Nested path seeds from Discover Paths via Crawling, Discover Paths via Directory Brute Force, or Discover Paths via OSINT Sources.
Downstream: findings into Generate Scan Report.
Parallel: the other five URL-list scanners on the same urls face. Same contract, different artifact class, unswappable H1s.

This family sits on the web tail after probe (hosts -> probe-web -> this family). It does not sit on hosts -> open-ports -> network FP -> (misconfig | weak-creds). Do not cross-wire to Scan Network Services for Misconfigurations; that takes port-details, not a URL list.

When to use this

Nest this after you have live web URLs and you want to know whether setup is still default: is the API public, is debug left on, can a visitor finish setup and take the box. A root-only URL list misses nested misconfigs; seed deeper paths from crawling or directory brute force when you care about paths under /app.

Inputs and outputs

Required: urls (FILE): live web server URLs, one per line. Example: https://foo.example.com, https://bar.example.com/app.
Optional: header (STRING): header(s) to include in HTTP requests.
header-file (FILE): file of header(s) to include.
rate-limit (STRING): max requests per second per machine. Default 300.
findings: JSONLines rows. Published fields: finding, location, severity, hostname, domain_name, ip_address, method, description, and the triggering request. Example rows: Uninitialized GitLab instances (high), Public Swagger API (info). v1.0.1 added Basic Auth at info.

Data

The tables this module produces. Sample rows are illustrative.

findings10 columns · 3 sample rows

Web misconfiguration findings: exposed APIs, debug surfaces, and default-state takeover.

	findingtext	locationurl	severitytext	matchestext	descriptiontext	hostnametext	domain_nametext	ip_addresstext	methodtext
1	Uninitialized GitLab Instance	https://git.example.com/	high	default-state	GitLab instance is uninitialized and can be taken over by completing setup.	git.example.com	example.com	203.0.113.30	GET
2	Public Swagger API	https://api.example.com/swagger.json	info	swagger-ui	Swagger API documentation is publicly accessible.	api.example.com	example.com	198.51.100.40	GET
3	Debug Surface Exposed	https://app.example.com/debug	high	debug-endpoint	Debug endpoint is reachable without authentication.	app.example.com	example.com	203.0.113.20	GET

How it differs from similar modules

Scan for Misconfigured Software

Artifact class it owns

Insecure setup: APIs, debug, default-state takeover

Upstream it needs

live urls

Outdated software

Artifact class it owns

Known CVE/CNVD HTTP matchers

Upstream it needs

live urls

Sensitive files

Artifact class it owns

Configs, logs, .git, .env

Upstream it needs

live urls

Exposed admin panels

Artifact class it owns

Upstream it needs

live urls

Exposed backups

Artifact class it owns

Hostname-named .bak/.sql/archives

Upstream it needs

live urls

Exposed secrets

Artifact class it owns

Token patterns in the live HTTP response

Upstream it needs

live urls

Do not 301 any of these six onto each other. Do not collapse this page into the network-services misconfig module (different tail, different input).

questions