Agent skill · security · jeremylongshore
detecting-directory-listing
Probe a target for directories that return auto-generated index listings instead of denying or serving a specific file — exposes the full file tree under any reachable directory, including files the application never linked to. Use when: post-deploy verification on a static-asset host, security audit before SOC2, or following up on a finding from skill #6 (exposed-files) where a backup-file path returned 200 with HTML body instead of the expected file content (suggests autoindex serving a directory listing). Threshold: any directory-shaped path returns 200 with HTML body matching the framework-specific autoindex fingerprint (nginx fancyindex, Apache mod_autoindex Index of/, Caddy browse, Lighttpd mod_dirlisting, etc.). Trigger with: "directory listing check", "autoindex detection", "open directory scan".
Why this skill is useful
Provides specific commands and patterns for detecting directory listings that the AI wouldn't reliably generate on its own.
What it needs
Requires python3 installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting Directory Listing Overview Web servers can be configured to auto-generate an HTML index page when a request hits a directory without a matching default file (no index.html / index.php / etc.). The auto-generated page lists every file in the directory. This is by design for static- file servers and FTP-style file-sharing setups; it's a misconfiguration on application servers where the file tree was never meant to be public. The risk compounds in two ways: 1. File enumeration without prior knowledge. Attackers find files you didn't link to (backup files, log files, old uploads). 2. Chaining with exposed-files (#6). A /.git/ request that returns an autoindex listing reveals every object file under .git/objects/ and confirms the entire repo is reachable for GitDumper-style reconstruction. This skill probes commonly-vulnerable directory paths and grades each based on the framework-specific autoindex fingerprint. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Application-root directory listing HIGH / returns autoindex page OWASP A05:2021 Backup / upload / log directory listing HIGH /backup/, /uploads/, /logs/, /dump/ autoindex CWE-548 Asset directory listing (/assets/, /static/) MEDIUM autoindex on asset dirs (enables file enumeration) CWE-548 Config directory listing CRITICAL /config/, /conf/, /.config/ autoindex NIST 800-53 SC-28 VCS subdir listing (chains with skill #6) CRITICAL /.git/, /.svn/, /.hg/ autoindex NIST 800-53 SC-28 Generic root reachable via autoindex MEDIUM / or arbitrary path autoindex on app server OWASP A05:2021 Prerequisites Python 3.9+ with requests Authorization for non-local targets Instructions Step 1 — Confirm Authorization Step 2 — Run the scanner Options: For each candidate directory path, the scanner appends a trailing slash and sends a GET. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-directory-listing--29d254