appscan漏洞--目录列表

来源：互联网发布：flothermal软件下载编辑：程序博客网时间：2024/04/30 08:54

直接访问http://xxx.xx.xxx.xx/images/后可以看到列表：

响应包含目录的内容（目录列表）。这表示服务器允许列示目录（通常不推荐此做法）

修改服务器配置以拒绝目录列表，修改httpServer的配置：/opt/IBM/HTTPServer/conf 的httpd.conf，看到

<Directory "/opt/IBM/HTTPServer/htdocs">

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI Multiviews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important. Please see
# http://publib.boulder.ibm.com/httpserv/manual70/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks =======>Options FollowSymLinks（去掉Indexes即可，表示不允许访问目录列表的意思）或者加上-号：Options -Indexes FollowSymLinks

#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride None

#
# Controls who can get stuff from this server.
#
Order allow,deny
Allow from all

</Directory>

0 0