Sometimes common directory names are exposed:

Append a slash ( / ) to the URL. If you see a plain list of files instead of a formatted webpage, you’ve found an open directory.