Directory listing of web site.

W

willemvdm

Well-Known Member
Joined
Apr 16, 2006
Messages
338
Reaction score
0
Location
Uitenhage
I've got a small website to advertize my business hosted by a hosting company, but I upload the content of the site myself. I don't have access to logs, at least I don't think so. If I do, I don't know where to find them. It is a cheap service with very little customer support. Prety much DIY.

I found a PHP script that alow you to check your email using a WAP browser, but there are no security build into this script and you place your username and password inside the script. The auther sugest you give the script a name that no one can guess, something like hafdghjf.php.

My question: Is it posable to get a directory listing of a website? My gut feeling is that it should not be posable, but how can I test my site to determin if it is posable or not to get a listing?

Don't want to stick this scrip on the site and then anyone can find it and open my mail. That is all the script does, it does not allow for delete, send or reply.

Thanks for any advise.
 
easy ? create a directory with some files and access it like http://www.mysite.com/directory/

If it show a directory just create a blank index.html then a directory listing is disabled anyway, cause it will open the index.html as default

What do you mean with cheap and no support.

I'll offer hosting for R30,00 and give support and help anybody who hasn't got the slightes clue
 
moklet said:
If it show a directory just create a blank index.html then a directory listing is disabled anyway, cause it will open the index.html as default

What do you mean with cheap and no support.

I'll offer hosting for R30,00 and give support and help anybody who hasn't got the slightes clue
Click to expand...

The PHP file I'm refering to, I will probably place in httpdocs so I can access it by http://www.aalwyne.co.za/***.php

My consern is that some hacker would be able to find this file and read my email. Simply need to know if it would be posable to find a file on a site if you don't know the name of the file.

Cheap - I pay R10 per month. Initially sighned up simply so I can fool around and learn a bit, but since it became a good advertising platform for my business. Though space is limited, I got all I need for now. Thanks for the offer.
 
If you create a file like this it's not uncommon for a search engine to find it. So I would suggest putting a robots.txt file in the site directory and to block access to search engines from this file.
What to put in the txt file:

User-agent: *
Disallow: /mailscript.php

I also offer hosting, check it out, don't it's your choice ;)
 
bullfrog, the problem is folks like me enjoy reading robots.txt, to see which directories folks like you are trying to hide.

the semi-recent riaa hack (where they uploaded mp3's to the riaa website) was carried out by reading robots.txt on the site and figuring out there is an admin directory disallowed.

with apache, you can permanently disable directory listings pretty easily. to find out if your host currently has listing turned on or off, create a blank directory as previously stated then try to browse to it. you either get a listing, or you get an error message "directory listing disallowed" or similar.
 
lol, guess I never thought of that one. The thing is that we don't know what options he has on his hosting package.

If you have cpanel you can set the directory listing on an off as you like as you mentioned above.

willemvdm: do you have anymore info on what hosting control panel you have access to on the server or is it just plain ftp access only? I guess making a blank index.html file will be the easiest way of doing it.

I see he does run apache:
There is one other way I know of, make a blank txt file and copy the following code into it:

Options All -Indexes

Upload the txt file onto the server via your ftp program, note that it must be uploaded in ASCII mode, needs to be set in ftp software.

Once it's on the server rename the file to ".htaccess". This will disable the index for the directory that the file is in.

Hope that helps!
 
Last edited:
The .htaccess line is just the thing I need. (I think) Added the above line to .htaccess. Then created a directory with test file in it and pointed browser to that directory (not the file) and got an "Access forbidden" Error. I got a progy called WinHTTrack that is supose to copy an entire site to your local hard drive. It does not find or copy that file. I'm just consern that there might be other simular programs that might be able to find such a file that a hacker might use.

Do you really think a bot can find it, even though there are NO links to that file?

Will still keep on searching the net to see if I can find any other loop holes befor I put the real file out there.

Thanks for your help.
 
Last edited:
If there are no other links to the file then it is unlikely that a bot will find it. I know there is another way of password protecting a directory and this password might be needed to access the contents too. I think you can also activate this with the .htaccesss file, will check it out and post my finding for you :)
 
First off, if the file is a .php file, no one can read it, unless it outputs the content to the browser. So even, if it was in www.aalwyne.co.za/config.php, no one can use it, unless they have SSH / FTP / physical access to the file from the server's side, or it displays the content to the browser.

Secondly, about 98% of PHP / ASP / .NET / etc script store the usernames, and passwords like this, it is safe todo so :)

Here's a test, upload this file to your website, and access it, to see what happens:

<?PHP
$name = "John";
$surname = "Andrews";
$username = "very big secret";
$password = "another, even bigger secret";

echo $name." ".$surname;
?>

See, it only displays the values of $name & $surname to the browser, the rest won't be visible. If someone has SSH, FTP, or physical access to your account, this is the last thing you worry about.

Secondly, most web servers don't allow directory access, and this can be confirmed, as said above by creating a folder, and accessing it with your browser. If you can see the dir, then the server allows access, in which can you could either create an empty index.html / inxex.php / index.phtml file, and the user won't see anyting, or you could use a .htaccess file to keep poeple out :)
 
LordMerlin said:
First off, if the file is a .php file, no one can read it, unless it outputs the content to the browser. So even, if it was in www.aalwyne.co.za/config.php, no one can use it, unless they have SSH / FTP / physical access to the file from the server's side, or it displays the content to the browser.
Click to expand...


or...as some buggy webserver software occasionally allows, add a fullstop after the .php bit

cant read file www.site.com/secret.php (php runs and script output shows)

can read file www.site.com/secret.php. (php doesnt run and script contents shows)

This has happened in the real world.
 
LordMerlin said:
First off, if the file is a .php file, no one can read it, unless it outputs the content to the browser. So even, if it was in www.aalwyne.co.za/config.php, no one can use it, unless they have SSH / FTP / physical access to the file from the server's side, or it displays the content to the browser.

Secondly, about 98% of PHP / ASP / .NET / etc script store the usernames, and passwords like this, it is safe todo so :)

Here's a test, upload this file to your website, and access it, to see what happens:

<?PHP
$name = "John";
$surname = "Andrews";
$username = "very big secret";
$password = "another, even bigger secret";

echo $name." ".$surname;
?>

See, it only displays the values of $name & $surname to the browser, the rest won't be visible. If someone has SSH, FTP, or physical access to your account, this is the last thing you worry about.

Secondly, most web servers don't allow directory access, and this can be confirmed, as said above by creating a folder, and accessing it with your browser. If you can see the dir, then the server allows access, in which can you could either create an empty index.html / inxex.php / index.phtml file, and the user won't see anyting, or you could use a .htaccess file to keep poeple out :)
Click to expand...

The problem is not so much people gaining access to the username and passwords, but someone using the script to access the emails. So anyone who knows that the script is there would be able to read your email, which is not good.
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X