I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only (possible) duplicate I found is one here and here. Additionally, first question is pointed up to Apache and .htaccess (rewrite rule to hide file extension). The second question is more pointed to doing direct SQL injection to a specific rest-styled website and not gathering URLs behind it.
Is there any way an attacker may find out what is behind REST-style URLs? For example, SWIM have a user "eg", located in database, which he query from mode.php. After query is done, the page print "eg" on website.
SWIM CMS use REST-style technique and while user is browsing SWIMs website, user can't see the parameters nor file which is being proceed. An example is shown below.
Is there a way an attacker may find out what is hiding behind
/mode/user/eg and by that chance try to exploit web-application using either injection or any type of attack. For example, if he founds out that the real URL is as in first example where parameter and it's value are visible, he may try doing SQL injection.
SWIM = Someone who isn't me