0

I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?

  • 3
    In IIS, it's a server side configuration. Directory Browsing can be enabled or disabled. – k1DBLITZ Sep 8 '15 at 16:24
4

Can you? Yes and No.

Yes if the website is either compromised, badly secured or the owner wants the site structure to be browseable.

No in other cases.

So the right question would be: why a website's directory structure must not be browsable?

For this last question, you may read the good answers to this question: PHP files browsable: is this a vulnerability?

2

No. There is no way to browse a directory of any website.

For example lets say you have a website with the url http://example.com/documents/document.doc I can check out http://example.com/documents/ to see if this can return the file index. If they have done nothing to prevent this you could see this file/folder structure returned. However the user could disable directory browsing on the server level. They may do this from a GUI like IIS or they could do it via configuration files like <directoryBrowse enabled="false" /> in IIS or Options -Indexes for Apache. They likely have their server configuration have a default directory document. In this case a simple blank index.htm, index.html, or whatever their root file is will prevent the directory listing if that file is found by the server regardless if directory browsing is enabled or not.

Since file discovery is becoming a common practice for recon in attacking websites or stealing sensitive information you will now notice more sites, web applications like CMSs, web server software and more are now disabling directory browsing by default. This means you can only spider a website for files to get a listing. But it would require you to brute force file/folder names or only be able to return file/folder names discovered through the public facing website.

With protections in place forcing a web server to list its contents just doesn't exist unless their is a vulnerability one could exploit.

  • 1
    How Can i spider the website to get list of webpages ? – DigviJay Patil Sep 9 '15 at 4:24
  • 1
    A spider goes through a page and extracts all links to pages and files it finds in that document. Like how Google spiders sites for it's search index. There are several free tools like web site copiers and site map creators that can help do this. Keep in mind this can hurt the bandwidth of the target site. – Bacon Brad Sep 9 '15 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.