Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I built a simple server containing static files at /files/ and I'm attempting to discover them using automated tools.

I'm using wfuzz to brute force on the URL but is that the only way? Is there any other method for URL discovery, probably more effective that could compromise the privacy of my server?

What other techniques do hackers use on the wild?

share|improve this question
up vote 5 down vote accepted

Discovery of URLs in the wild tends to be done in one of three ways

  1. Search Engine Based. If your content gets indexed by a search engine, it's discoverable. this doesn't just include them hitting your site directly, if other sites link to the content it may be findable that way.
  2. "known URLS". There's a lot of URLs that are known to be things like administrative interfaces or CGIs with known issues. Tools like nikto maintain a database of them and can be used by attackers to discover systems which have that software installed.
  3. Brute-force. Tools like OWASP DirBuster combined with lists of common directory/file names can be used to discover content.

In terms of an untargeted attack unless you have a common vulnerable piece of software (e.g. phpmyadmin) hosted on a default URL, it's unlikely you'll have a problem as the sheer number of sites on the Internet make it unlikely that you'll face a human attacker focused on finding content on your site.

With a targeted attacker tools like nikto and dirbuster would be usuable to try and find content on your site.

If you have information that you don't want to be found I would recommend adding authentication and SSL to it to prevent unauthorised access to it.

share|improve this answer

One way would be to use a tool called ZAP, it has similar of DirBuster but you can use dictionary forced browsing to try common urls.

ZAP is a free tool from OWASP

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.