91 lines
2.3 KiB
YAML
91 lines
2.3 KiB
YAML
id: directory-listing
|
|
|
|
info:
|
|
name: Directory Listing Enabled
|
|
author: theMiddle
|
|
severity: low
|
|
description: Directory Indexing is a web server feature that allows the contents of a directory to be displayed when no index file is present. This can be a security risk as it can expose sensitive files, old backup or unreferenced files.
|
|
reference:
|
|
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/04-Review_Old_Backup_and_Unreferenced_Files_for_Sensitive_Information
|
|
- https://portswigger.net/kb/issues/00600100_directory-listing
|
|
tags: miscellaneous,misc,generic,misconfguration,web
|
|
|
|
flow: |
|
|
function target_is_in_scope(url) {
|
|
if (url.startsWith(template.http_1_host) || url.startsWith("/")) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
http(1);
|
|
|
|
if(template.links) {
|
|
var path_checked = [];
|
|
var paths = [];
|
|
|
|
for(i=0; i<template.links.length; i++) {
|
|
if (target_is_in_scope(template.links[i])) {
|
|
|
|
var path = template.links[i].replace(template.http_1_host, "");
|
|
var path_split = path.split("/");
|
|
var path_to_check = "";
|
|
|
|
for(p in path_split) {
|
|
if (path_split[p] != "") {
|
|
path_to_check += "/"+path_split[p];
|
|
|
|
if (!path_checked.includes(path_to_check)) {
|
|
path_checked.push(path_to_check);
|
|
|
|
set("path_to_check", path_to_check);
|
|
http(2);
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
redirects: true
|
|
matchers:
|
|
- type: status
|
|
internal: true
|
|
status:
|
|
- 200
|
|
- type: word
|
|
words:
|
|
- "text/html"
|
|
part: header
|
|
extractors:
|
|
- type: xpath
|
|
name: links
|
|
part: body
|
|
internal: true
|
|
xpath:
|
|
- "//*/@href|//*/@src"
|
|
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}{{path_to_check}}"
|
|
redirects: true
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: status
|
|
internal: true
|
|
status:
|
|
- 200
|
|
- type: word
|
|
words:
|
|
- "text/html"
|
|
part: header
|
|
- type: word
|
|
words:
|
|
- "<title>Index of"
|
|
part: body
|