Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Assume the following sample directory:

- /
- /images
- /28374728127636438
- /css

Directory listing is disabled on the server and the directory named 28374728127636438 never linked anywhere on the actual web page. This directory contains the backend of the web site. It is secured by a http auth and php login, but can an attacker still find this directory? Is there some method to force a web server in listing files and directories? Does security through obscurity work in this case?


Note: I am on shared webhosting. I cannot control anything outside my htdocs folder and only have .htaccess available. All directories that contain PHP or template code have a

deny from all

in their .htaccess and other folders have an empty index.html along with options -Indexes to avoid listing.

share|improve this question
If the attacker gains shell access it will be found. – Deer Hunter Sep 2 '14 at 9:54
@DeerHunter That is out of my reach, since it is a shared webhoster, so nobody outside that company SHOULD gain that. – DeleteMe Sep 2 '14 at 10:26
@DeerHunter That's like saying if you leave the door of your safe open, your valuables will be found. I can't think of a more pointless statement to make. Anyway, OP already understands that this is nothing more than security through obscurity, and it's pretty common knowledge that security through obscurity is a pretty bad approach. Why don't you use SSL along with the http auth? Then you can avoid the error prone, questionable practice of using strange directory names. – Steven Lu Sep 2 '14 at 14:53

Arguably if there's enough entropy in the folder name then it may provide some benefit in a layered security approach (ie. one of many controls you have implemented). Doing so may help to cut down "noise" from attackers who don't really pose a significant threat, however you cannot depend on an attacker not finding the folder name because it can be leaked too easily.

For example, the directory name might be leaked via the HTTP referer header or it could be leaked if your application has a vulnerability which allows an attacker to list directories.

If the contents of this directory are important then use strong authentication and access control. I'd recommend implementing IP white listing if possible, and if these are static resources that need to be accessed by the public (eg. attachments) then store them outside the document root and have your application proxy (ie. read and output) them to users following appropriate authentication.

share|improve this answer
Well, the referer header would only be sent if I visit a website via my admin panel then.How could an attacker list my directories? The only attack vector an attacker has is the parameters on my URLs. No other user generated input exists. – DeleteMe Sep 2 '14 at 10:28
If you can absolutely grantee that your application is secure and that no external URLs in your admin panel then it will make it more difficult for an attacker, but it's then just an issue of entropy and brute force. Remember than an embedded image in an <img> tag will generate a referer header so you need to be sure there are no instances of this where the src is a resource you don't control. – thexacre Sep 2 '14 at 10:41
So as long as I have no external images in my admin panel, it is pretty much undiscoverable. With the exception of a brute force hit. I cannot control any parameters of the server or permissions, I am only on shared webhosting. Please keep that in mind. All I have is FTP and .htaccess options. IP white listing is not feasible, since I get a new IP every day. – DeleteMe Sep 2 '14 at 15:02
@NoneOfYourBusiness Another possible way of leaking the directory would be when the admins http connection is eavesdropped on. This can be avoided with https, but it sounds like you are using a very low-budget hoster where https might be unavailable. – Philipp Sep 2 '14 at 16:33

Well one way that it can be discovered is via the clients which access it.

So if a user browses to your directory from a machine which is shared for example, or has malware installed on it or (assuming you're not using SSL) is on a wireless network, then the name of the directory could be accessible to an attacker.

A user might inadvertently share a link to this directory in e-mail as the background to a screenshot of other data on their machine etc.

A user might be logged into their browser which then synchronizes their browser history to other machines that they are logged into and into the "cloud".

For these reasons I wouldn't rely on the obscurity of a directory name as a means of securing access to a web server, the login and authentication you mentioned should be the main controls.

share|improve this answer

Directory brute forcing can be used to enumerate the directory, this can be done using tools like Directory Buster for Directory Enumeration These tools have millions of words of lists, which are bruteforced on the website, to enumerate directories. This is done at a rapid speed.

To counter this, make the directory name as complex as possible to avoid getting caught in directory bruteforceing tools

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.