What misconfiguration allows attackers to view server contents via a web directory index?

What misconfiguration allows attackers to view server contents via a web directory index?

• A. Directory listing enabled (Index Of)
• B. Firewall blocking access
• C. Password-protected directories
• D. Encrypted file storage

Answer: (A)

Directory listing is the misconfiguration that lets someone view what’s inside a web directory. When a server is configured to show a directory’s contents and there’s no index page to hide it, the server may render an Index Of page that lists all files and subfolders. Seeing those filenames, paths, and potentially sensitive items enables an attacker to map the site and identify targets for further compromise. The fix is to disable directory listings, ensure a proper index page is present, and apply access controls so directories aren’t exposed publicly. The other options don’t fit because blocking with a firewall prevents access, password protection requires authentication and hides contents from unauthenticated users, and encryption protects data at rest or in transit but doesn’t prevent a public directory listing from revealing file names.

Directory listing is the misconfiguration that lets someone view what’s inside a web directory. When a server is configured to show a directory’s contents and there’s no index page to hide it, the server may render an Index Of page that lists all files and subfolders. Seeing those filenames, paths, and potentially sensitive items enables an attacker to map the site and identify targets for further compromise. The fix is to disable directory listings, ensure a proper index page is present, and apply access controls so directories aren’t exposed publicly. The other options don’t fit because blocking with a firewall prevents access, password protection requires authentication and hides contents from unauthenticated users, and encryption protects data at rest or in transit but doesn’t prevent a public directory listing from revealing file names.