Agent skill · security · jeremylongshore
detecting-directory-listing
Probe a target for directories that return auto-generated index listings instead of denying or serving a specific file — exposes the full file tree under any reachable directory, including files the application never linked to. Use when: post-deploy verification on a static-asset host, security audit before SOC2, or following up on a finding from skill #6 (exposed-files) where a backup-file path returned 200 with HTML body instead of the expected file content (suggests autoindex serving a directory listing). Threshold: any directory-shaped path returns 200 with HTML body matching the framework-specific autoindex fingerprint (nginx fancyindex, Apache mod_autoindex Index of/, Caddy browse, Lighttpd mod_dirlisting, etc.). Trigger with: "directory listing check", "autoindex detection", "open directory scan".
Why this skill is useful
Adds a specialized script for probing directory listings that the AI wouldn't reliably generate on its own.
What it needs
Requires python3 installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting Directory Listing Overview Web servers can be configured to auto-generate an HTML index page when a request hits a directory without a matching default file (no index.html / index.php / etc.). The auto-generated page lists every file in the directory. This is by design for static- file servers and FTP-style file-sharing setups; it's a misconfiguration on application servers where the file tree was never meant to be public. The risk compounds in two ways: 1. File enumeration without prior knowledge. Attackers find files you didn't link to (backup files, log files, old uploads). 2. Chaining with exposed-files (#6). A /.git/ request that returns an autoindex listing reveals every object file under .git/objects/ and confirms the entire repo is reachable for GitDumper-style reconstruction. This skill probes commonly-vulnerable directory paths and grades each based on the framework-specific autoindex fingerprint. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Application-root directory listing HIGH / returns autoindex page OWASP A05:2021 Backup / upload / log directory listing HIGH /backup/, /uploads/, /logs/, /dump/ autoindex CWE-548 Asset directory listing (/assets/, /static/) MEDIUM autoindex on asset dirs (enables file enumeration) CWE-548 Config directory listing CRITICAL /config/, /conf/, /.config/ autoindex NIST 800-53 SC-28 VCS subdir listing (chains with skill #6) CRITICAL /.git/, /.svn/, /.hg/ autoindex NIST 800-53 SC-28 Generic root reachable via autoindex MEDIUM / or arbitrary path autoindex on app server OWASP A05:2021 Prerequisites Python 3.9+ with requests Authorization for non-local targets Instructions Step 1 — Confirm Authorization Step 2 — Run the scanner Options: For each candidate directory path, the scanner appends a trailing slash and sends a GET. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-directory-listing