Detections
Analytics

WG170 IIS6 - Each readable web document directory must contain a default, home, index or equivalent file. - 'DefaultDoc'

Information

The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server's directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.

 NOTE: Review each website's default documents list to ensure each site contains a default document.

 NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Add a default document to the applicable directories or disable directory browsing.

See Also

http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, Rule-ID|SV-30002r1_rule, STIG-ID|WG170_IIS6, Vuln-ID|V-2245

Plugin: Windows

Control ID: f7e48db327f7961a20b92a840728303ebfb9cdefa4120ba974a8b0cab393f849