the-web-application-hackers-handbook

678 Chapter 18 n Attacking the Application Server
Figure 18-6: A directory listing
In many situations, directory listings do not have any relevance to security. For
example, disclosing the index to an images directory may be inconsequential.
Indeed, directory listings are often disclosed intentionally because they provide
a built-in means of navigating around sites containing static content, as in the
example illustrated. Nevertheless, there are two main reasons why obtaining
directory listings may help you attack an application:
n Many applications do not enforce proper access control over their functionality
and resources and rely on an attacker’s ignorance of the URLs
used to access sensitive items (see Chapter 8).
n Files and directories are often unintentionally left within the web root of
servers, such as logs, backup files, and old versions of scripts.
In both of these cases, the real vulnerability lies elsewhere, in the failure to
control access to sensitive data. But given that these vulnerabilities are extremely
prevalent, and the names of the insecure resources may be difficult to guess,
the availability of directory listings is often of great value to an attacker and
may lead quickly to a complete compromise of an application.