What are common files on a web server that can be misconfigured and provide useful Information for a hacker such as verbose error messages?

Question

Options

• Ahttpd.conf
• Badministration.config
• Cidq.dll
• Dphp.ini

• A
  6% (3)
• C
  4% (2)
• D
  91% (48)

Explanation

php.ini is the primary PHP configuration file that, when misconfigured, can expose sensitive information to attackers - most notably by enabling display_errors = On, which causes verbose error messages revealing file paths, database structures, version numbers, and internal logic that hackers can exploit.

Why the distractors are wrong:

• A. httpd.conf is the Apache web server configuration file; while it can be misconfigured, it primarily controls server behavior (ports, directories, modules) rather than directly generating verbose application-level error messages to end users.
• B. administration.config is not a standard, widely recognized web server configuration file - it's essentially a distractor with no specific common association to verbose error exposure.
• C. idq.dll is a Windows/IIS file associated with the historic Code Red worm vulnerability, making it relevant to exploits, but it is not a configuration file that produces verbose error messages.

Memory Tip: Think "PHP = Pretty Helpful (for) Penetration testers" - when PHP's php.ini is misconfigured with error display turned on, it practically hands a hacker a roadmap of the application. If you see a question about configuration files and verbose errors together, think PHP → php.ini.

No community discussion yet for this question.