By making a request to the Apache web server ending in '?M=A' it is sometimes possible to obtain a directory listing even if an index.html file is present. It appears that it is possible to retrieve a directory listing from the root of the Apache web server being tested. However, this could be because there is no 'index.html' or similar default file present.
Unless it is required, turn off Indexing by making the appropriate changes to your httpd.conf file.
- Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities
- Apache Traffic Server HTTP TRACE Request Remote DoS Vulnerability
- IIS IDA/IDQ Path Disclosure
- Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
- IBM WebSphere Application Server Multiple CSRF Vulnerabilities