I typed just one address and the folder opened as is.
Enter the site address in the browser address bar, followed by /uploads/ Try adding . No login screen or error screen appears. Index of /uploads/ The file list appears as is with the title. You'll see names like contract scans, employee rosters, and database dumps all lined up.
It's not like I'm exceeding my authority or piercing anything. When there is no file to use as the first screen in that folder Let the server draw the list for you It's because it's done. So anyone who knows the address sees the same screen.
I only sent one request
BlueCanvas review archiveA home screen request was sent once to each of the 641 remaining addresses, followed by one more request to each of the five static routes.
| confirmed | place |
|---|---|
| Target with remaining address | 641 places |
| Where the request was answered | 615 places |
| Where the folder list opens as is | 5 locations (2 locations open more than 2 locations) |
| Where the product name and version are read as is | 106 places |
| Where there are none of the three lines of the protection header | 405 locations (30 locations with all three) |
The open path is /images/ 3 places, /data/ 2 places, /uploads/ 1 place, /files/ There was 1 place /backup/ There were 0 places. Five places is not a large number. However, places that are open are open to anyone.
Reveal how to measure. on the home screen and five static routes each on August 31, 2026. GET only once Sent. Redirects were tracked up to 4 times, timeout was 10 seconds, and 8 concurrent threads. No authentication, no parameter manipulation, no retries. The actual file names in the open list have not been moved, and the screens in the video and text are reproductions.
Even if the listings are closed, the site speaks for itself
Even if the folder listing is closed, the site sends an introduction along with its response to the request.
HTTP/1.1 200 OK
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k
X-Powered-By: PHP/5.4.16
Content-Type: text/html; charset=UTF-8What it is made of and what edition it is is clearly written on it. Among the 615 responding 106 placesThe product name and version were read, and the most common values were OpenSSL/1.0.2 in 14 places, Apache/2.4.6 in 11 places, PHP/5.4.16 in 8 places, and PHP/7.4.33 in 8 places. Are these values still supported? What happens to sites that haven't updated their PHP version for 3 years?This was dealt with separately.
Reducing and adding are different
You need to look at two things separately here. Because the nature of the work is different, grouping them together would result in poor judgment.
| personality | something | yes |
|---|---|---|
| reducing | information revealed | Automatic display of folder list, Server product/version, X-Powered-By |
| more work | Rules for your browser | HSTS, X-Frame-Options, Content-Security-Policy |
These items The absence does not confirm infringement. Conversely, having everything does not make you safer. The structure is different for each site. It's not something that can be done all at once with just a few lines of settings. For example, if Content-Security-Policy is set incorrectly, the screen you are using may freeze. So this article ends with “Check this first,” not “Fix it like this.”
All you have to do today is ask
Just send two lines to management. You can copy and use it as is.
- “Could you please check whether there is a place in the public folder where the file list can be opened as is?” You can ask to see paths that open without logging in, such as image/upload/data room.
- “Please also check whether the product name and version are included in the response header.” If the exposure is unnecessary, you can ask them to determine whether it can be reduced.
Both are items that can be answered just by checking them. It is safer for someone in charge who knows the site structure to decide what to change and how to change it. We can also check with you to see what you can see outside.
