WebOTG-SM-004 — Directory Listing and Indexing

Objective

Directory indexing occurs when a web server generates a response containing a listing of files and directories because an index resource is absent and directory browsing is permitted.

Directory listings can expose deployment artifacts, backup files, uploaded content, application resources, documentation or other information that was not intended to form part of the public interface.

Scope

Review publicly accessible directories including, where applicable:

Prerequisites

Methodology

The assessment should combine direct HTTP observation with configuration review. A successful directory response alone does not establish that the exposure is a security finding.

Test procedure

Directory discovery

Example HTTP request

GET /assets/ HTTP/1.1
Host: example.test
Accept: text/html

Potential response indicators

Exposure assessment

The security significance of directory indexing depends primarily on what the listing exposes and whether those resources are intended to be public.

Expected result

The preferred default for most application directories is to serve known resources rather than expose an automatically generated directory index.

Failure criteria

Consider the procedure failed when directory indexing is unintentionally enabled and the resulting exposure creates a meaningful security or information-disclosure risk.

Remediation

Disable automatic directory indexing for directories where listing is not required. Remove unnecessary files from the public web root wherever possible.

Recommended approach

1. Disable directory indexing by default.
2. Remove unnecessary files from public directories.
3. Move internal resources outside the public web root.
4. Restrict directories that must remain accessible.
5. Ensure upload directories expose only intended resources.
6. Review deployment pipelines for accidental publication of temporary or backup files.
7. Document any intentional public directory listing.

Apache example

<Directory "/var/www/public">

    Options -Indexes

</Directory>

Nginx example

location / {
    autoindex off;
}

Verification

Evidence requirements

Classification

References

WebOTG should maintain source URLs, document versions and review dates centrally through its content-management system so that references can be updated without modifying the procedure template.