nuclei-templates/http/miscellaneous/dir-listing.yaml

id: dir-listing

info:
  name: Directory listing enabled
  author: _harleo,pentest_swissky,hczdmr
  severity: info
  reference:
    - https://portswigger.net/kb/issues/00600100_directory-listing
  tags: misc,generic
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        part: body
        words:
          - "Directory listing for "
          - "Index of /"
          - "[To Parent Directory]"
          - "Directory: /"
        condition: or
        case-insensitive: true

      - type: regex
        part: body
        regex:
          - '\d{1,2}\/\d{1,2}\/\d{4}\s+\d+:\d+\s+[\sAPM]+(&lt;dir&gt;|\d+)\s+<[Aa]\s+[hH][rR][eE][fF]="\/'
          - '\s+-\s+\/<\/(title|h1)>'
        condition: and
Add dir-listing.yaml Checks whether basic directory listing is enabled at root 2020-04-05 16:19:21 +00:00			`id: dir-listing`

			`info:`
			`name: Directory listing enabled`
updated for case sensitive matcher 2023-01-09 08:52:31 +00:00			`author: _harleo,pentest_swissky,hczdmr`
uniform severity update 2020-08-03 21:52:00 +00:00			`severity: info`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://portswigger.net/kb/issues/00600100_directory-listing`
Update dir-listing.yaml 2021-08-11 07:59:46 +00:00			`tags: misc,generic`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
Add dir-listing.yaml Checks whether basic directory listing is enabled at root 2020-04-05 16:19:21 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Add dir-listing.yaml Checks whether basic directory listing is enabled at root 2020-04-05 16:19:21 +00:00			`- method: GET`
Update syntax 2020-05-25 08:02:27 +00:00			`path:`
Preparing for request clustering 2021-01-13 07:31:46 +00:00			`- "{{BaseURL}}"`
Miscellaneous template updates 2022-01-28 10:24:49 +00:00
Add dir-listing.yaml Checks whether basic directory listing is enabled at root 2020-04-05 16:19:21 +00:00			`matchers:`
			`- type: word`
Update dir-listing.yaml 2022-12-09 06:51:06 +00:00			`part: body`
Update syntax 2020-05-25 08:02:27 +00:00			`words:`
Update dir-listing.yaml 2022-12-09 06:51:06 +00:00			`- "Directory listing for "`
updated word matcher 2020-04-09 12:44:55 +00:00			`- "Index of /"`
Update dir-listing.yaml On IIS, there is no "Index of /" but the webpage contains the URL and a link to the parent directory "[To Parent Directory]" when directory listing is enabled. 2020-04-15 08:00:08 +00:00			`- "[To Parent Directory]"`
Update dir-listing.yaml Came across a couple of Jetty based applications with directory listing. 2020-12-13 20:22:24 +00:00			`- "Directory: /"`
Update dir-listing.yaml 2022-12-09 06:51:06 +00:00			`condition: or`
updated for case sensitive matcher 2023-01-09 08:52:31 +00:00			`case-insensitive: true`
Update dir-listing.yaml 2022-12-09 06:51:06 +00:00
			`- type: regex`
			`part: body`
			`regex:`
			`- '\d{1,2}\/\d{1,2}\/\d{4}\s+\d+:\d+\s+[\sAPM]+(<dir>\|\d+)\s+<[Aa]\s+[hH][rR][eE][fF]="\/'`
			`- '\s+-\s+\/<\/(title\|h1)>'`
			`condition: and`