- Listen to our monthly AppSec Stats Flash podcast
- LEARN MORE
Directory Indexing (also known as Directory Browsing or Listing) occurs when a web server expose’s directory listings on a site that could yield potentially confidential data. Directory Indexing takes advantage of insecure indexing to expose confidential data on a site. A misconfigured server can show a directory listing, which potentially yields sensitive information to an attacker. Indexing site contents via a process that has access to files not destined for consumption has the potential to leak information about the existence of such files, and also about their content. In the process of indexing, such information is collected and stored by the indexing process, which can later be retrieved by a determined attacker, typically through a series of queries to the search engine.
If a user tries to navigate to www.whitehatsec.com/admin1. The web server processes this request and searches the document root directory for the default file name and sends this page to the client. If this page is not present, the web server will issue a directory listing and send the output to the client
This means a user could view and download the content of a directory located on a server.
Directory Indexing is an example of not one but possibly two OWASP TOP 10 vulnerabilities. First Directory Indexing is server misconfiguration, Depending on the files that are exposed this could lead to Sensitive Data exposer.
The vulnerability occurs as an attacker may have access to all the files present in the architecture of the web application. This can lead to attackers access information that normally they would not be able to access. Some examples of the files would be:
Web administrators often assume if there are no hyperlinks to these documents, no one will be able to find them. But using web hacking techniques and vulnerability scanner can dynamically add additional directories/files to include in their scans based on data obtained in initial probes. Directory Indexing will then allow a leak that supplies an attacker with the information needed to launch further attacks against the system.
To remediate this disable indexing on the configuration file on the web server