Automated Detection of web and cloud Misconfigurations

Madasamy, Nishanth (2026) Automated Detection of web and cloud Misconfigurations. Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (608kB) | Preview
Preview	PDF (Configuration Manual) Download (552kB) | Preview

Abstract

Modern web applications are increasingly relying on distributed APIs, cloud storage services, and federated authentication mechanism. While these technologies provide scalability and interoperability, they also introduce a large attack surface if not properly configured. Misconfigurations in policies associated with Cross-Origin Resource Sharing (CORS), Amazon S3 bucket permissions and OAuth/OpenID Connect (OIDC) identity flows continue to be among most prevalent and damaging vulnerabilities exploited in real-world attacks. Existing security tools usually target misconfigurations in only one of these domains and therefore produce fragmented security assurance assessments and inconsistent coverage during penetration testing and cloud auditing. This research proposes a Unified Web Misconfiguration Detection Suite, which is a multi-vector command-line-based scanning framework that aims to detect critical misconfigurations in CORS, S3 and OAuth/OIDC implementations. The system consists of three specialized scanners implemented in Python, each designed to emulate attacker behavior. The CORS misconfiguration scanner which tests for origin reflection, credential leakage and preflight vulnerabilities, the S3 bucket scanner which performs unauthenticated testing of public listing, read and write permissions and the OAuth/OIDC scanner which conducts passive analysis of discovery endpoints, JavaScript files and authentication flows for insecure configurations. A vulnerable laboratory environment with a Flask-based CORS test server, intentionally misconfigured OAuth endpoints and multiple S3 bucket scenarios were constructed to validate and benchmark the scanners. Experimental results show that the unified suite reliably detects many different misconfigurations causing high-severity issues. reflected CORS origins, publicly writable S3 buckets, insecure token flows, missing PKCE, exposed secrets and improper metadata in OAuth/OIDC providers. The results validate that grouping the misconfiguration detection in one framework offers superior visibility when compared to using separate tools. This project contributes a practical approach from an attacker perspective to multi-vector web and cloud misconfiguration assessment, as well as the importance of automating tooling to mitigate security risks in the modern web application ecosystem.

Item Type:	Thesis (Masters)
Supervisors:	Name Email Hafeez, Khadija UNSPECIFIED
Uncontrolled Keywords:	CORS misconfiguration; S3 buckets; Web application security; Automated Security Testing
Subjects:	Q Science > QA Mathematics > Electronic computers. Computer science T Technology > T Technology (General) > Information Technology > Electronic computers. Computer science T Technology > T Technology (General) > Information Technology > Cloud computing Q Science > QA Mathematics > Computer software > Computer Security T Technology > T Technology (General) > Information Technology > Computer software > Computer Security
Divisions:	School of Computing > Master of Science in Cyber Security
Depositing User:	Ciara O'Brien
Date Deposited:	09 Nov 2026 18:20
Last Modified:	09 Nov 2026 19:05
URI:	https://norma.ncirl.ie/id/eprint/9950

Actions (login required)

View Item