Directory Listing

??Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory.

??It is dangerous to leave this function turned on for the web server because it leads to information disclosure.

??Directory listings themselves do not necessarily constitute a security vulnerability.

??Any sensitive resources within the web root should in any case be properly access-controlled and should not be accessible by an unauthorized party who happens to know or guess the URL.

Directory Listing Importance?:-

??Today’s businesses depend upon online directories to make it easy for customers to find out everything they need to know.

??A?directory listing?is a type of Web page that lists files and directories that exist on a Web server.

??It is Designed to be navigated by clicking directory links.

??Directory listings typically have a title that describes the current directory, a list of files and directories that can be clicked, and often a footer that marks the bottom of the directory listing.

Directory Listing Example?:-

??A user makes a website request to www.vulnweb.com/admin/.?The response from the server includes the directory content of the directory?admin as seen in the below screenshot :

??From the above directory listing you can see that in the?admin?directory there is a sub-directory called?backup and which might include enough information for an attacker to craft an attack.

??This directory includes sensitive files such as password files, database files, FTP logs, and PHP scripts. It is obvious that this information was not intended for public view.

Impact :

??A directory listing provides an attacker with the complete index of all the resources located inside of the directory.

??The specific risks and consequences vary depending on which files are listed and accessible.

??The files can possibly expose sensitive information as well as sensitive files like private videos or photos.

How to Disable Directory Listing in Apache Web Server And Nginx?:

Apache Web Server :

??To disable directory listing you must change your web server configuration and you can do that by disabling directory listing by setting the?Options?directive in the Apache?httpd.conf?file by adding the following line:

<Directory /your/website/directory>Options -Indexes</Directory>

??You can also add this directive in your .htaccess?files but make sure to turn off directory listing for your entire site but not just for selected directories.

Nginx :

??Directory indexing is disabled by default in nginx so you do not need to configure anything.

??In case if it was turned on before, you can turn it off by opening the?nginx.conf?configuration file and changing?autoindex on?to?autoindex off.

Mitigation?:-

??There is not usually any good reason to provide directory listings and disabling them may place additional hurdles in the path of an attacker.

???This can normally be achieved in two ways:

i.?Configure your web server to prevent directory listings for all paths beneath the web root.

ii.?Place into each directory a default file (such as index.htm) that the web server will display instead of returning a directory listing.

Reference :-

https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/.