Contents
When to disable directory listing on your web server?
Directory listing is a feature that when enabled the web servers list the content of a directory when there is no index file (e.g. index.php or index.html) present. Therefore if a request is made to a directory on which directory listing is enabled, and there is no index file such as index.php or index.asp,…
How does redirection work in ASP.NET MVC 2?
To understand the vulnerability, let’s look at how the login redirection works in a default ASP.NET MVC 2 Web Application project. In this application, attempting to visit a controller action that has the [Authorize] attribute will redirect unauthorized users to the /Account/LogOn view.
How does directory listing work on a web server?
Directory listing is a feature that allows web servers to list the content of a directory when there is no index file present. Therefore if a request is made to a directory on which directory listing is enabled, and there no index file such as index.php or index.asp, the web server sends a directory listing as a response.
What is an open redirection attack in ASP.NET?
This tampering is called an open redirection attack. Whenever your application logic redirects to a specified URL, you must verify that the redirection URL hasn’t been tampered with. The login used in the default AccountController for both ASP.NET MVC 1.0 and ASP.NET MVC 2 is vulnerable to open redirection attacks.
How to enable and disable web directory listing in jetty?
You can specify specific locations to disable it selectively. To enable directory listing, you use the autoindex on option in the file. Just like Tomcat Server, Jetty is a HTTP web server and a Java servlet container. Again, the directory listing is controlled by the default servlet in this case.
Why does the web server send a directory listing?
Therefore if a request is made to a directory on which directory listing is enabled, and there is no index file such as index.php or index.asp, even if there are files from a web application, the web server sends a directory listing as a response.
How to disable directory listing in Tomcat server?
The param-name called listings is the parameter that controls the directory listing feature in the Tomcat server. You can disable the directory listing feature by setting the param-value to false for this param. You can set it to true if you want to enable the feature.