> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_03-directory-listing.md).

# recon\_03 (directory listing)

View the exercise here: [PentesterLab: Recon 03](https://pentesterlab.com/exercises/recon_03/course)

### **OBJECTIVE**

For this challenge, your goal is to find a directory with directory listing in the main website for **hackycorp.com**.

### **DIRECTORY LISTING**

When accessing a directory on a webserver, multiple things can happen:

* an "index" file is present and it will get returned. N.B.: the file is not necessarily named **index**, this can be configured. But most of the time, the file will be named **index.html**
* no "index" file is present and the webserver will list the content of the directory. This can obviously leak information.

Indexing directory can be disabled on most webservers. For example, with Apache, you need to use the option: **-Indexes**.

To find directories, with indexing turned on. You need to browse the source of the HTML pages and look at the directories used to store files. Once you have a list of directories, you can access each of them individually.

### **SOLUTION**

Go to `hackycorp.com` > *Right-click* > then `View Page Source`

<div align="left"><figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FSlkytXIk0lqic7Yqmzui%2FScreenshot_2024-08-22_at_18.15.11.png?alt=media&amp;token=480862fd-629f-4a8c-8139-3464251be3bb" alt=""><figcaption></figcaption></figure></div>

Click `/images/logo.png`

Then it will lead you to the site: `https://hackycorp.com/images/logo.png`

<div align="left"><figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FpDxwjrj1FKUwXhN2JmgQ%2FScreenshot_2024-07-15_at_20.47.15.png?alt=media&amp;token=e66aa806-827f-4aa3-b442-f6ed24cab12b" alt="" width="336"><figcaption></figcaption></figure></div>

Erase the `/logo.png` in the URL - ***this is a classic directory listing misconfiguration***

<div align="left"><figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FSN9wIxIDXFAJzpvgFBND%2FScreenshot_2024-07-15_at_20.49.34.png?alt=media&amp;token=627a75f8-fb99-4fb5-a4c6-98b0d6667c37" alt="" width="563"><figcaption></figcaption></figure></div>

{% hint style="success" %}
Click **`key.txt`** file to see the flag.
{% endhint %}

<div align="left"><figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FOANmUDGDjXzyglRleMHj%2FUntitled.png?alt=media&amp;token=d3c8f2e9-45f0-48fc-9340-499997a40205" alt="" width="521"><figcaption></figcaption></figure></div>