Accessing or downloading from some directories may violate the Computer Fraud and Abuse Act (CFAA) in the US or similar laws globally if you bypass any form of authentication (even weak ones).
When a web server is poorly configured, it generates an automatic list of files inside a folder if a standard landing page (like index.html ) is missing. Search engines find these lists and index them. Why Exposed Directories Happen index of parent directory uploads free
: A link found on these pages that allows you to move one level up in the server's folder hierarchy. Accessing or downloading from some directories may violate