CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A security audit finds that a web server has directory listing enabled for the /uploads/ directory. An attacker visits the URL. What can they see?
- A.Only public files explicitly marked for directory listing
- B.Directory listing only shows folder names, not file names
- C.The attacker sees an HTML index of all files in the directory - uploaded files, configuration files, backup files, and any other content stored there - without needing to know specific filenames
- D.Directory listing is a browser feature and does not expose server files
Why C is correct
Directory listing (Apache: Options Indexes, Nginx: autoindex on) generates an HTML page showing all files in a directory. Attackers use this to: enumerate uploaded files, find backup files (.bak, .sql), discover configuration files left in web directories, and download all content. Always disable directory listing. In Apache: 'Options -Indexes'; in Nginx: ensure 'autoindex off' is set (the default).
Know someone studying for Web App Fundamentals? Send them this one.