0x0A: Säkerhetspodcasten intervju Hanno Böck

## Overview Hanno Böck, a security researcher, discusses findings from his investigation into accidental file exposure and wget-based vulnerabilities discovered through web misconfigurations. The interview takes place at Säkerhetspodcasten's 10th anniversary event, with host Midori.

## Key Topics

**The wget Investigation** Böck explains how his research began when two people contacted him regarding wget vulnerabilities—specifically, the ability to download directories from web pages deployed with wget. This observation sparked deeper investigation into related configuration and file exposure issues.

**MySQL Dumps and Database Access** A critical finding involves MySQL database dumps being left in web roots with standard filenames (such as dump.sql) from the documentation. These are easily discoverable and downloadable by attackers. Server logs showed others attempting to download such files, suggesting the vulnerability was known informally but never publicly discussed in articles or blog posts.

**PHP Core Dumps** When PHP applications crash, the system can generate core dumps (memory dumps) in the web root depending on configuration. These dumps contain sensitive information, particularly database passwords stored in variables. While Böck found PHP crashes are common corner cases that developers don't prioritize fixing, he has not found a reliable way to remotely trigger crashes consistently.

**Magento Configuration Vulnerability** Magento stores configuration in XML files containing database passwords. Unlike PHP files (which are parsed and protected), XML files are plain text and downloadable. While Magento uses .htaccess restrictions, this only works on Apache; nginx deployments require manual configuration. When reported through Magento's bug bounty program, the company indicated the issue was already known but provided no timeline for fixes.

**Research Methodology** Böck scanned the Alexa top 1 million websites to assess prevalence. He considered certificate transparency logs as an alternative for broader domain discovery but chose the limited scope to avoid abuse concerns. When informing affected organizations, he contacts abuse contacts—not an ideal use of responsible disclosure channels, but effective.

**Artifacts and Misconfigurations** The research reveals that web roots contain unintended files including old configuration files, swap files, and backup artifacts. These emerge from development processes or abandoned domains.

## Key Findings

Böck emphasizes that while individual customers responded positively when notified (removing exposed files), the Magento vulnerability in particular received minimal public attention. However, a German article generated significant media impact in Germany, including coverage of issues with the German Postal Service's systems.

The speaker released tools to facilitate scanning, expressing dissatisfaction with the limited availability of public vulnerability scanning tools for these issues. He notes that as frameworks mature and domains are abandoned, JavaScript inclusion attacks and other configuration-based vulnerabilities will likely increase.

## Takeaways

The research demonstrates that sensitive files routinely end up in web roots through misconfiguration, developer shortcuts, or inadequate understanding of web server behavior across different platforms. While individual organizations can remediate when notified, systematic change requires greater public awareness and better default security practices. Böck hopes releasing scanning tools will improve the overall security posture.