Parent Directory Security Issues

malhyp · February 1st, 2006, 09:14 AM

Hi there, is there any way of restricting access to your parent directory. I dont want everyone to see all the folders I have on my site. If i type on the web www.mywebsite.com.au/html I get the following directory. Ho do I stop it?

--------------------------------------------------------------------------------

[To Parent Directory]
Thursday, 26 January 2006 7:28 AM <dir> _notes
Sunday, 29 January 2006 10:49 PM 19392 addEmployment.asp
Tuesday, 31 January 2006 9:55 PM 18707 addEtrade.asp
Tuesday, 31 January 2006 9:50 PM 18777 addEvent.asp
Sunday, 29 January 2006 10:50 PM 13386 AdRotatorInformation.asp
Tuesday, 17 January 2006 7:23 PM 729 AdRotatorRedirector.asp
Tuesday, 31 January 2006 9:55 PM 19750 AdRotatorRegistration.asp
Sunday, 29 January 2006 3:57 PM 578 AdRotatorSchedule.txt
Sunday, 29 January 2006 4:14 PM 4278 AdRotatorViewHits.asp
Tuesday, 31 January 2006 9:44 PM 19512 advertise.asp
Sunday, 29 January 2006 3:57 PM 14286 applicationexample.asp
Tuesday, 31 January 2006 9:55 PM 26497 applicationFree1.asp
Sunday, 29 January 2006 10:50 PM 33983 applicationfree2.asp
Sunday, 29 January 2006 10:50 PM 23935 applicationfree3.asp
Wednesday, 1 February 2006 8:07 PM 12132 applicationthankyou.asp
Tuesday, 31 January 2006 9:55 PM 19613 cantfindit.asp
Sunday, 29 January 2006 10:50 PM 14614 careers.asp
Thursday, 29 December 2005 11:59 PM 400 connTimber.asp
Sunday, 29 January 2006 10:50 PM 18312 contactUs.asp

Imar · February 1st, 2006, 12:48 PM

Hi malhyp,

You can put a default document in the root of the folder you want to block.

Depending on the configuration of your server, this document should be called Default.asp or Index,asp (although other configurations are possible as well). With this document in the folder, user see that document when they enter a path without a file name.

E.g. http://www.yourdomain.com/

will result in

http://www.yourdomain.com/Default.asp

being displayed, provided the root folder contains Default.asp.

In addition to this, you can also disable "Directory Browsing" in IIS for the entire application or specific folders.

Cheers,

Imar