Directory Browsing

Summary

It is possible to view a listing of the directory contents. Directory listings may reveal hidden scripts, include files, backup source files, etc., which be accessed to reveal sensitive information.

Solution

Configure the webserver to disable directory browsing.

References

• https://www.zaproxy.org/docs/alerts/10033/
• https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration.html
• https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
• https://cwe.mitre.org/data/definitions/548.html