Secure Legion Labs
Labs / Misconfig / Directory Listing

Misconfiguration Lab

Directory Listing Exposure

This room simulates a public web directory where indexing was left enabled. Your goal is to browse exposed folders, locate the sensitive backup area, and retrieve the leaked configuration file that should never have been web-accessible.

ObjectiveEnumerate exposed filesBrowse indexed directories and pull the sensitive backup file.
FocusPublic storage mistakesLearn how harmless-looking directory indexes lead to credential and config leaks.
FlagUnlock after sensitive file accessThe flag appears only when you retrieve the intended leaked file.
Assessment Notes

Observed during recon

HTTP Behavior

The target returns a generated index page instead of a 403 when certain directories are requested directly.

Likely Risk

Backup and export folders are often forgotten because teams assume obscurity is enough.

Testing Direction

Start with ordinary web-accessible directories, then pivot toward paths that usually hold archives, exports, or old operational files.

What To Browse

Likely paths

  • Startpublic static-style paths
  • Pivotbackup and archive folders
  • Targetindexed storage areas
  • Goalsensitive backup file exposure
Browser Console

Browse a path

Use the exposed directory listing exactly like a tester would: enumerate folders first, then pivot into backup files.

Current request: GET /
{ "status": "idle" }
Directory listing preview
Rendered Output

Indexed content

The server returns raw directory indexes instead of restricting access. Once the right path is reached, the leaked backup file becomes directly retrievable.

No path requested yet.

Status: waiting for a path request.

Flag Unlock

Challenge flag

The flag appears after you retrieve the intended sensitive backup file.

Flag:
Submit Flag

Validate completion

Submit the unlocked flag to complete the room.

Flag is locked until you retrieve the leaked backup file.

Exposure Path

How the weakness works here

1. Find indexed folder

The server returns a browsable listing instead of denying direct directory access.

2. Enumerate deeper paths

The tester pivots from harmless folders toward backup or export locations.

3. Retrieve sensitive file

A forgotten backup file becomes directly accessible through the public web root.