Application testing cases - describe possible security misconfiguration issues.

Is the web server running outdated or unsupported software? Are built-in accounts still enabled or set with default passwords? Are built-in extraneous features (i.e.debug pages, sample code, demo/test functionality) accessible? Do application error messages reveal stack traces or debug information?​ Does the web server support unnecessary HTTP methods?