Creating a directory browsing page using ASP

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 7.0 running on Microsoft Windows Server 2008. IIS 7.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:For more information about IIS 7.0, visit the following Microsoft Web site:


Microsoft IIS provides file and folder listings through the Directory Browsing access control setting, which can be set at the folder or Web level. Using the file system objects for Active Server Pages (ASP), you can create pages that function like directory browsing without having to enable directory-browsing access, and allow a greater level of personalization and customization.

More Information

Save the following ASP code as "Default.asp" (without the quotation marks) in folders where you require directory listings:
WARNING: ANY USE BY YOU OF THE CODE PROVIDED IN THIS ARTICLE IS AT YOUR OWN RISK. Microsoft provides this code "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
Option Explicit
On Error Resume Next

' this section is optional - it just denies anonymous access
If Request.ServerVariables("LOGON_USER")="" Then
Response.Status = "401 Access Denied"
End If

' declare variables
Dim objFSO, objFolder
Dim objCollection, objItem

Dim strPhysicalPath, strTitle, strServerName
Dim strPath, strTemp
Dim strName, strFile, strExt, strAttr
Dim intSizeB, intSizeK, intAttr, dtmDate

' declare constants
Const vbReadOnly = 1
Const vbHidden = 2
Const vbSystem = 4
Const vbVolume = 8
Const vbDirectory = 16
Const vbArchive = 32
Const vbAlias = 64
Const vbCompressed = 128

' don't cache the page
Response.AddHeader "Pragma", "No-Cache"
Response.CacheControl = "Private"

' get the current folder URL path
strTemp = Mid(Request.ServerVariables("URL"),2)
strPath = ""

Do While Instr(strTemp,"/")
strPath = strPath & Left(strTemp,Instr(strTemp,"/"))
strTemp = Mid(strTemp,Instr(strTemp,"/")+1)

strPath = "/" & strPath

' build the page title
strServerName = UCase(Request.ServerVariables("SERVER_NAME"))
strTitle = "Contents of the " & strPath & " folder"

' create the file system objects
strPhysicalPath = Server.MapPath(strPath)
Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
Set objFolder = objFSO.GetFolder(strPhysicalPath)
<title><%=strServerName%> - <%=strTitle%></title>
<meta name="GENERATOR" content="The Mighty Hand of Bob">
BODY { BACKGROUND: #cccccc; COLOR: #000000;
FONT-FAMILY: Arial; FONT-SIZE: 10pt; }
TABLE { BACKGROUND: #000000; COLOR: #ffffff; }
TH { BACKGROUND: #0000ff; COLOR: #ffffff; }
TD { BACKGROUND: #ffffff; COLOR: #000000; }
TT { FONT-FAMILY: Courier; FONT-SIZE: 11pt; }

<h1 align="center"><%=strServerName%><br><%=strTitle%></h1>
<h4 align="center">Please choose a file/folder to view.</h4>

<div align="center"><center>
<table width="100%" border="0" cellspacing="1" cellpadding="2">
<th align="left">Name</th>
<th align="left">Bytes</th>
<th align="left">KB</th>
<th align="left">Attributes</th>
<th align="left">Ext</th>
<th align="left">Type</th>
<th align="left">Date</th>
<th align="left">Time</th>

' output the folder list

Set objCollection = objFolder.SubFolders

For Each objItem in objCollection
strName = objItem.Name
strAttr = MakeAttr(objItem.Attributes)
dtmDate = CDate(objItem.DateLastModified)
<td align="left"><b><a href="<%=strName%>"><%=strName%></a></b></td>
<td align="right">N/A</td>
<td align="right">N/A</td>
<td align="left"><tt><%=strAttr%></tt></td>
<td align="left"><b><DIR></b></td>
<td align="left"><b>Directory</b></td>
<td align="left"><%=FormatDateTime(dtmDate,vbShortDate)%></td>
<td align="left"><%=FormatDateTime(dtmDate,vbLongTime)%></td>
<% Next %>

' output the file list

Set objCollection = objFolder.Files

For Each objItem in objCollection
strName = objItem.Name
strFile = Server.HTMLEncode(Lcase(strName))

intSizeB = objItem.Size
intSizeK = Int((intSizeB/1024) + .5)
If intSizeK = 0 Then intSizeK = 1

strAttr = MakeAttr(objItem.Attributes)
strName = Ucase(objItem.ShortName)
If Instr(strName,".") Then strExt = Right(strName,Len(strName)-Instr(strName,".")) Else strExt = ""
dtmDate = CDate(objItem.DateLastModified)
<td align="left"><a href="<%=strFile%>"><%=strFile%></a></td>
<td align="right"><%=FormatNumber(intSizeB,0)%></td>
<td align="right"><%=intSizeK%>K</td>
<td align="left"><tt><%=strAttr%></tt></td>
<td align="left"><%=strExt%></td>
<td align="left"><%=objItem.Type%></td>
<td align="left"><%=FormatDateTime(dtmDate,vbShortDate)%></td>
<td align="left"><%=FormatDateTime(dtmDate,vbLongTime)%></td>
<% Next %>


Set objFSO = Nothing
Set objFolder = Nothing

' this adds the IIf() function to VBScript
Function IIf(i,j,k)
If i Then IIf = j Else IIf = k
End Function

' this function creates a string from the file atttributes
Function MakeAttr(intAttr)
MakeAttr = MakeAttr & IIf(intAttr And vbArchive,"A","-")
MakeAttr = MakeAttr & IIf(intAttr And vbSystem,"S","-")
MakeAttr = MakeAttr & IIf(intAttr And vbHidden,"H","-")
MakeAttr = MakeAttr & IIf(intAttr And vbReadOnly,"R","-")
End Function
Because this page functions in place of directory browsing access, you should disable directory browsing for any folder where this page is saved. To do this, use the following methods.

Method 1: Windows NT Server 4.0

  1. Click Start, click Run, type Inetmgr, and then click OK.
  2. Double-click the server that is running the WWW service.
  3. Click the Directories tab, click the folder that you want, and then click to clear the Directory Browsing Allowed check box.
  4. Click OK.

Method 2: Windows 2000 Server

  1. Click Start, click Run, type Inetmgr, and then click OK.
  2. Double-click the server that you want. Expand the Web site that you want, if it is required.
  3. Right-click the Web site or the virtual directory that you want, and then click Properties.
  4. Click the Home Directory tab, and then click to clear the Directory browsing check box.

    Note The Home Directory tab may appear as the Directory tab or the Virtual Directory tab.
  5. Click OK.
For more information about Microsoft scripting languages, view the following Microsoft Web site: