How to browse a website which allows directory browsing but has a default page?

Question

There is a website which allows directory browsing; I know this for sure because I can browse directories where there is no default page.

There is a directory which I want to browse, but it instead has a default page, so that page is displayed if I type the URL in my browser, or if I click on that directory when browsing the directory above it (which, as said, allows browsing).

How can I ask the web server to send me the directory listing instead of the default page?

I'm currently using Internet Explorer, but I don't mind using another browser if IE is not up to the task.

Solution 1

You can't.

In the standard configuration of all popular web servers, the term "allows browsing" only applies when the directory in question does not have a default page, to avoid introducing a large security hole.

(In some configurations (for example, DirectorySlash off in Apache2), http://example.com/path/ displays the index page while http://example.com/path returns the index, but this is very rare.)

The browser used does not matter; all they do is send a HTTP request and display returned data. It's entirely up to the server whether to display the index or the default page.

Solution 2

Sometimes you can browse a directory that has a default or index file. The only way I have found to do so is to find a sub directory on the site that lacks a default or index file and then traverse from there. For instance say you're on an image site you might get a listing by clicking on an image and then removing the image file name from the url and pressing enter. Of course this won't work if listing is disabled.

Comments

[Codebling]

You might want to check out the Wikipedia article on directory traversal, though it's not strictly related to your question.

[surfasb]

Next time, you should word your question different. First give the problem like "I have some files I keep on the webserver that I want to be able to access with a web browser." Then state your current situation, which is directory traversal. Lastly, offer the specification of an acceptable solution, like "must work on a PC and iPhone." That would probably get your somewhere faster.

[karan punjabi]

I was hoping for something better... but this seems to be true. Answer accepted, thanks anyway.

[3Dom]

@user1686 does this apply to crawlers too? I'm struggling to find documentation on whether an index.html or index.php conceals contents of a directory from bad bots.

[user1686]

Crawlers do not have any special access to the website. They're just ordinary HTTP clients, no more and no less. So if they know a direct URL to one of the "concealed" files, they will still be able to access it – but if they only know a URL to the directory, with no file listing, then they won't.

[3Dom]

Amazing @user1686 thank you so much for the quick reply. It obviously stands to reason, but wanted to hear it from someone such as yourself. Thank you kindly. This is one of those questions that has gone un-asked and un-answered in my head for a long time. Thank you :)