Index of /wp-content/uploads




Try it yourself:

There are plenty of other “Index of” combinations out there:

  1. “Index of /admin”
  2. “Index of /password”
  3. “Index of /mail”
  4. “Index of /” +passwd
  5. “Index of /” password.txt

Now obviously if someone is using WordPress and uploading content, it’s more than likely related to their blog, and perfectly okay for the world to sneak a peak. However, for those sites that are using WordPress as a corporate platform, with confidential information (don’t ask me why you would want to do this with WordPress…), this is a huge security issue.

Moral of the story, unplug your computer, no one is safe.

Here are a bunch I found in a forum while actually doing a search on _vti (Front Page extensions).

filetype:htpasswd htpasswd
intitle:"Index of" “.htpasswd" -intitle:"dist"
           -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurl:passlist.txt (para encontrar listas de passwords)
intitle:"Index of..etc" passwd
intitle:admin intitle:login
“Incorrect syntax near" (SQL script error)
intitle:"the page cannot be found" inetmgr
intitle:index.of ws_ftp.ini
“Supplied arguments is not a valid PostgreSQL result"
_vti_pvt password intitle:index.of
inurl:backup intitle:index.of inurl:admin
“Index of /backup"
“Index of /admin"
“Index of /password"
“Index of /mail"
“Index of /" +passwd
Index of /" +.htaccess
Index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: “index of/admin"
allintitle: “index of/root"
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
filetype:config web
gobal.asax index
inurl:passwd filetype:txt
inurl:admin filetype:db
allinurl: winnt/system32/ (get cmd.exe)
intitle:"Index of" .sh_history
intitle:"Index of" .bash_history
intitle:"Index of" passwd
intitle:"Index of" people.1st
intitle:"Index of" pwd.db
intitle:"Index of" etc/shadow
intitle:"Index of" spwd
intitle:"Index of" master.passwd
intitle:"Index of" htpasswd
intitle:"Index of" members OR accounts
intitle:"Index of" user_carts OR user _cart

Tags: , , , , , ,

Comments are closed.