I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files).
Do you think this is a security hole ? If yes, in which sense ?
What you're describing is normal directory listing
In itself, directory listing is not a security issue. If the security of your system is compromised after figuring out the structure of your files and directories, then you're relying on security through obscurity, which is bad. Examples of this bad practice include:
However, as part of a good security policy, after implementing proper security measures, it's beneficial to obscure the working parts of your system. The less you show about your system, the less information an attacker can get on you, which means you're making their job more difficult.
"So, what should I do?" you ask. Simple: Disable directory listing in your web server configurations. In Apache, you go to your
Yes.. This is definitely an issue.
If I know your structure, I will be able to get better understanding of your system which makes me easier to attack your system.
It is recommended to turn off your directory listing (See this tutorial if you are on CPanel)
The less hackers know, the harder they need to think..
To add to the answers of @adnan and @william-calvin:
It "may" be a problem ;)
So, as explained by the others - it is bad practice. It gives out more information then it should.
To add to Adnan's answer, some PHP frameworks, like PyroCMS, solve the problem in your question by using a combination of
By the way, yes, it is bad practice to have these files browsable. The point with this answer is that there are tools you can use to prevent you from having to repeat boilerplate code thousands of times over, sometimes literally, and it just so happens the topics in this question involve boilerplate code these tools can help with.
Yes, regarding to above answers, I don't want to share same information, but real event that happened to my organization.
We had a web server (Front end of which clients can see their internet account information, ability to recharge, etc).
The developer uploaded a BigDump to backup the triple A server data, in that while, an attacker reviewed the directory listening and found dump file which contain all scratch cards and account information, hopefully, he reported to me and we solved this issue.
As also mentioned, relying on security through obscurity, its better to disable directory listening, I made a policy for my organization that this feature should be disabled in all web servers.
BTW, there is no
To save your PHP driven website from the script kiddies, you can read my long tutorial for hardening WordPress (I provided link for copyright protection plus probably you'll know about more unknown vulnerable points). WordPress is just an example, actually the content is applicable to any PHP-MySQL or even PHP driven website.
Secondly, unrelated to the original question; The Linux Kernel should be hardened too. You can see my gist - https://gist.github.com/AbhishekGhosh/9407137
Normally PHP will not open in the browser like a text file, but showing the path, name and probably gives the indication that the server administrator is not very experienced and makes it more vulnerable.
Do not try to control from