don't allow directory browsing on grtp.co

How it was found

Hello guys,

Details: The web server is configured to display the list of files contained in this directory. As a result of a misconfiguration - end user / attacker able to see content of the folders with systemically important files According to yours Scope (any other software we publish) - I found that one of sites: grtp.co is vulnerable to Directory listening

Vulnerable place: http://grtp.co/v1/ http://grtp.co/v2/

PoC:

{F104876}

Impact: Exposing the contents of a directory can lead to an attacker gaining access to source code or providing useful information for the attacker to devise exploits, such as creation times of files or any information that may be encoded in file names. The directory listing may also compromise private or confidential data.

Remediation:

• Configure your web server to prevent directory listings for all paths beneath the web root;
• Place into each directory a default file (such as index.htm) that the web server will display instead of returning a directory listing.

Let me know if you have any question.

Thanks for your attention, Stas