---
title: "Directory Browsing"
description: "HawkScan test information for plugin 0: Directory Browsing"
url: https://docs.stackhawk.com/vulnerabilities/0/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# Directory Browsing

###### Reference

- **Plugin ID:** 0
- [**CWE:** 548](https://cwe.mitre.org/data/definitions/548.html)
- **WASC:** 48
- **Risk:** Medium
- **Type:** Active
- **Category:** Information Leakage

### Remediation

To prevent directory browsing vulnerabilities, follow these steps:

1. **Disable directory browsing:** Disable directory browsing in your web server configuration. For example, in Apache, you can add the following line to your `.htaccess` file or virtual host configuration:

   ```apache
   Options -Indexes
   ```

   This will prevent the server from generating directory listings when no index file is found.

2. **Secure sensitive files:** Ensure that sensitive files, such as scripts, include files, and backup source files, are not accessible through directory browsing. Move them to a location outside of the web root directory or use server-side configuration to deny access. For example, in Apache, you can use the following configuration in your `.htaccess` file or virtual host configuration:

   ```apache
   <FilesMatch "\.(php|inc|bak)$">
       Order allow,deny
       Deny from all
   </FilesMatch>
   ```

   This will deny access to files with extensions `.php`, `.inc`, and `.bak`.

3. **Regularly update and patch:** Keep your web server software and applications up to date with the latest security patches. Vulnerabilities in the server software or applications can be exploited to bypass directory browsing protections.

### About

Directory browsing is a vulnerability that allows an attacker to view the directory listing of a web server. By default, web servers generate directory listings when no index file (e.g., `index.html`, `index.php`) is found in a directory. This can reveal sensitive information, such as hidden scripts, include files, backup source files, and other files that may contain sensitive data.

### Risks

The risks associated with directory browsing vulnerabilities include:

- **Disclosure of sensitive information:** Directory browsing can expose sensitive files and directories that were not intended to be publicly accessible. This can include configuration files, source code, database backups, and other sensitive data.

- **Information leakage:** The directory listing can provide valuable information to an attacker, such as the directory structure, file names, and potentially vulnerable files that can be targeted for further exploitation.

- **Increased attack surface:** Directory browsing can provide an attacker with additional information that can be used to plan and execute further attacks on the web server or its applications.

- **Privacy violations:** Directory browsing can expose private or confidential information that should only be accessible to authorized users. This can lead to privacy violations and potential legal consequences.