 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 180
 Members: 0
 Total: 180
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
list directory contents and download them |
|
 Posted: Fri Feb 29, 2008 1:01 am |
 |
|
| Panic_Mode |
| Active user |
 |
|
| Joined: Feb 09, 2008 |
| Posts: 39 |
|
|
|
 |
|
 |
|
Acunetix scanner (or other web vulnerability scanners) can show the structure of a site and the files which are saved in each folder.
Is there a more "silent" way to get the files inside a folder of a website, eg. get the directory ww.example.com/images/ or at least list them...?
Is there any server side restrictions for not letting people getting directory's full content or listing it (i guess noone would be happy if someone downloaded his php scripts)?
tnx in advance  |
|
|
|
|
|
|
|
|
| Posted: Fri Feb 29, 2008 1:55 am |
|
|
| ToXiC |
| Moderator |
 |
|
| Joined: Dec 01, 2004 |
| Posts: 181 |
| Location: Cyprus |
|
|
|
|
|
|
There are no silent ways and acunetix doesnt list directorys.
What acunetix does is indexing through the website and searching for .jpg,.js files lets say that have path for example at http://site.com/imagefolder/bla.jpg so the structure of the site is
site.com
---/imagefolder/
if you have for example an empty index.htm file at /imagefolder/ that directory cannot be listed . but you can say that is exists.
or you can play with the .htaccess file as well
You can create a .htacess file in your directory and add the following parameter in it
IndexIgnore *
or if you want to hide specific extensions
IndexIgnore *.gif *.jpg (this will allow listin of .html and other files beside gif and jpg |
|
_________________
who|grep -i blonde|talk; cd~;wine;talk;touch;unzip;touch; strip;gasp;finger;gasp;mount; fsck; more; yes; gasp; umount; make clean; sleep;wakeup;goto http://www.md5this.com |
|
|
|
|
|
|
|
| Posted: Fri Feb 29, 2008 9:29 am |
|
|
| Panic_Mode |
| Active user |
|
|
| Joined: Feb 09, 2008 |
| Posts: 39 |
|
|
|
|
|
|
|
Ah I see.
Tnx for the reply.
So there is not a way of listing the contents of directory... |
|
|
|
|
| Posted: Fri Feb 29, 2008 11:57 am |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| Panic_Mode wrote: | Ah I see.
Tnx for the reply.
So there is not a way of listing the contents of directory... |
This is how webserver works ... If someone finds a way to index arbitrary Apache directory, then it can be seen as security hole and next day issue will be patched  |
|
|
|
|
| Posted: Fri Feb 29, 2008 9:47 pm |
|
|
| Panic_Mode |
| Active user |
|
|
| Joined: Feb 09, 2008 |
| Posts: 39 |
|
|
|
|
|
|
|
| waraxe wrote: | | Panic_Mode wrote: | Ah I see.
Tnx for the reply.
So there is not a way of listing the contents of directory... |
This is how webserver works ... If someone finds a way to index arbitrary Apache directory, then it can be seen as security hole and next day issue will be patched |
I was hoping for a common missconfiguration exploit or something :p |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
