S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
medium·Misconfiguration·Updated Dec 16, 2023

Directory Listing Vulnerability Scanner

Misconfiguration of the web server has led to file list disclosure and the data is publicly available.

Est. Time~20 minutes
Scan TypeSingle Scan
Targetsurl
CostFree
3.1k
Times Used
continuous scan runs
5.8k
Continuously Checked
assets under CS
3.2k
Vulnerabilities Found
confirmed findings
Detail

Directory listing is a setting in a web server that determines whether the server will return a list of the files in a directory when someone visits that directory. The directory listing setting is usually turned off for security reasons since it can allow people to see the contents of unprotected directories on the server. Viewing files in the directory can lead to information disclosure, which is the unauthorized release of sensitive information. Turning off directory listing helps to protect against this type of attack. It is important to note that disabling directory listing does not make a directory inaccessible. It simply prevents the contents of the directory from being displayed when someone visits it. If you want to prevent people from accessing a directory, you need to protect it with a password or some other form of authentication.

Solution Advice

Most web servers allow you to turn on or off directory listing for specific directories.Some methods to disable directory listing:

In the Apache web server, you can use the following steps:

Open the /etc/apache2/apache2.conf file.Find the “Options Indexes FollowSymLinks”Change the line with “Options -Indexes +FollowSymLinks”Save and close the file. Then, restart the Apache webserver.

In the IIS web server, you can use the the following steps:

Open the IIS Manager.Select the project for which you want to disable the listing of files.Double-click the Directory Browsing icon in the IIS section.Click Disable.

In the Nginx web server, you can use the following steps:

Open the /etc/nginx/sites-available/default file.Add the following line to the configuration file: autoindex off;Save and close the file. Then, restart the Nginx service.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.