1

More specifically, how can I theoretically find the files that is in a website's root directory?

For example:

My current imaginary website has 2 folders (labeled rescources and screenies) and 3 files (labeled index.html, index.alt.html, and favicon.ico).

I am aware that, if no index.html or index.php exists, Apache automatically routes users that attempts to visit that virtual host to a directory page giving raw access to the files in the root folder (or whichever folder they specify).

Because most folders and or root directories of people's web servers have an index.html or index.php, the average user cannot access a directory page listing all files in the active directory... Right?

Is there a way that, not including brute-forcing to attempt to find the directory name, a user can find my rescources or screenies folders, or even my index.alt.html without being told to navigate to https://[MY_SERVER]/rescources/ or has found where an html file that they have access to has referenced it?

Improve this question
4
  • You are looking for the Apache Options Index found here: wiki.apache.org/httpd/DirectoryListings – closetnoc Jun 16 '16 at 23:34
  • Does knowing about them because you asked this question count? – Stephen Ostermiller♦ Jun 17 '16 at 10:40
  • "raw access to the files in the root folder..." you refer to is called Directory Listing/Browsing. Disabling it has been discussed here: stackoverflow.com/questions/2530372/… – user2320464 Jun 17 '16 at 16:22
  • 1
    Always assume that there is. Even if you have directory listing turned off. If you want it protected, put password control on it as a bare minimum. A couple decades show that things have a way of leaking, even if nobody knows they exist. – Fiasco Labs Jun 18 '16 at 6:39
1

If you discount that a person has some inside knowledge, the answer is no. How can anyone know about something that they can't see or know about?

But what is the point of having these folders if you aren't using some of the content? Assuming you do use the content, unless you are doing some really fancy coding, then you have to link to the content and therefore the answer is also yes, as those links are going to be visible in source code.

Improve this answer
2
  • Apache used to have directory indexing enabled by default. I am not sure this is still true in newer versions since I go through and disable these tings right away without thinking about it. If directory indexing is enabled, then anyone should be able to get a directory index if one of the default files, such as index,html, index.htm, index.php, etc. do not exist within the directory. – closetnoc Jun 17 '16 at 16:12
  • That is if the source code is presented client-side (javascript, etc). Server-side code referencing your "hidden" files/folders will remain "hidden". – user2320464 Jun 17 '16 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.