Journal of Digital Convergence (디지털융복합연구)

The Society of Digital Policy and Management (한국디지털정책학회)
권호 표지
DOI QR코드

DOI QR Code

Vulnerability of Directory List and Countermeasures

디렉토리 리스팅 취약점 및 대응책

  • Hong, Sunghyuck (Division of Information and Communication, Baekseok University)
  • Received : 2014.07.12
  • Accepted : 2014.10.20
  • Published : 2014.10.28
Download PDF
⟨ Previous Next ⟩

Abstract

The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may contain files that are not normally exposed through links on the web site. The directory list have some serious vulnerability to show internal files and directory to outsider attackers. Therefore, the proposed countermeasure of directory list is presented to prevent unnecessary valuable information from outsider attackers.

본 논문은 디렉토리 리스팅이란 서버 시스템의 파일을 볼 수 있는 것으로 디렉토리 리스팅의 취약점을 갖고 있는 사이트를 찾는 방법과 보완하는 방법이 무엇이 있는지 알아본다. 검색 사이트인 구글을 이용하여 디렉토리 리스팅 취약점이 있는 사이트를 찾는 법, 구글 검색에 내가 운영하는 사이트가 검색되지 않는 방법과 웹 서버의 운영자가 할 수 있는 취약점 제거 방법을 제시한다.

Keywords

References

  1. Kaiping Liu; Hee Beng Kuan Tan; Shar, L.K., Semi-Automated Verification of Defense against SQL Injection in Web Applications, Software Engineering Conference (APSEC), 2012 19th Asia-Pacific , vol.1, no., pp.91,96, 4-7 Dec. 2012.
  2. JOHNNY LONG, Google Hacking for Penetration Testers Vol., No., pp. 41-62, 2010.
  3. Beaver Kevin, Hacking for Dummies 4th Edition, V ol., No., pp. 281-282, 2012.
  4. Seungju Jang, Juneho Kim, Design of files and direc tories with security features within the Windows O. S. using Visual C++, Vol. 7, No. 1, pp 510-514, 2009
  5. Acevedo, B.; Bahler, L.; Elnozahy, E.N.; Ratan, V.; Segal, M. E., Highly available directory services in DCE, Fault Tolerant Computing, Proceedings of Annual Symposium on, vol., no., pp.387,391, 25-27 Jun 1996
  6. DOI: http://dx.doi.org/10.1109/HPCA.1999.744354
  7. DOI: http://dx.doi.org/10.1109/IEEESTD.1994.122164
  8. Jae-Nam Woo, Red Hat Fedora Linux Server & Network, Vol., No., pp. 573-575, 2010.
  9. S. B. Hong, Linux Server Security Management Practices 2nd Edition, Vol, 1. No., pp.85-86, 2008.
  10. KISA, Web Server Security Check's Guide, pp. 64-65, 2010
  11. B. Moore, E. Elleson, J. Strassner, A. Westerinen, "Policy Core Information Model", Request for Comments RFC 3060, February 2001.
  12. J.Halpern, S.Convery, R. Saville, "IPSec Virtual Private Networks in Depth VPN", Cisco Systems White Paper, June 2001.
  13. DOI: http://dx.doi.org/10.1109/TPDS.2005.4