This listing is what you see when you encounter an Index of /xxx page. It looks similar to this:
autoindex off; – Uncheck "Directory Browsing" in Feature Delegation. 2. Create Default Index Files Place an empty index.html or a index.php file in every directory. Better yet, use a single line in Apache:
| Search Query | Potential Exposure | | --- | --- | | intitle:"index of" "passwords" | Plaintext password files, .htpasswd | | intitle:"index of" "backup" | Database backups, SQL dumps, zipped source code | | intitle:"index of" "private" | SSH keys, certificates, internal memos | | intitle:"index of" "credit card" | Financial logs, payment CSVs | | intitle:"index of" "etc/shadow" | Linux password hashes (highly critical) |
DirectoryIndex index.html index.php index.htm default.html Add:
Index of /documents [ICO] Name Last modified Size Description [DIR] parent/ 2024-01-15 10:32 - [ ] report.pdf 2024-01-10 09:12 2.1MB [ ] data.csv 2024-01-05 14:22 450KB The keyword – where xxx is a placeholder for a specific folder name, file type, or keyword – is used by researchers, penetration testers, and unfortunately, malicious actors to locate these exposed directories on the internet. The Google Dork: intitle:"index of" "xxx" Google’s advanced search operators can pinpoint specific server configurations. The classic dork is: