appscan漏洞--目录列表

直接访问http://xxx.xx.xxx.xx/images/后可以看到列表：

响应包含目录的内容（目录列表）。这表示服务器允许列示目录（通常不推荐此做法）

修改服务器配置以拒绝目录列表，修改httpServer的配置：/opt/IBM/HTTPServer/conf 的httpd.conf，看到

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
#   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI Multiviews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important.  Please see
# http://publib.boulder.ibm.com/httpserv/manual70/mod/core.html#options
# for more information.
#
    Options  Indexes FollowSymLinks    =======>Options   FollowSymLinks（去掉Indexes即可，表示不允许访问目录列表的意思）或者加上-号：Options -Indexes FollowSymLinks


#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
#   Options FileInfo AuthConfig Limit
#
    AllowOverride None


#
# Controls who can get stuff from this server.
#
    Order allow,deny
    Allow from all