Directory Listing Enabled
Web servers with directory listing enabled expose the file structure and contents of directories without index files. This can reveal sensitive files, backup archives, configuration files, and application internals.
Overview
Directory listing is a web server feature that displays the contents of a directory when no index file is present. While useful during development, it exposes the complete file structure in production, allowing attackers to discover backup files, configuration files, source code, temporary files, and other sensitive resources.
Impact
Information disclosure, discovery of sensitive files, backup file access, source code exposure.
Examples
Exposed Directory
https://example.com/backup/ => database_dump.sql.gz => config.bak => .env.production
Remediation
Disable directory listing on all web servers, add index files to all directories, configure server to return 403/404 for directory requests.
Disable directory listing in web server configuration
Add index.html files to all public directories
Configure the server to return 403 for directory requests
Remove backup and temporary files from web-accessible directories
Related SuperClue scanner checks
These scanner checks look for signs of Directory Listing Enabled. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works