Assume the following sample directory:
- / - /images - /28374728127636438 - /css
Directory listing is disabled on the server and the directory named
28374728127636438 never linked anywhere on the actual web page. This directory contains the backend of the web site. It is secured by a http auth and php login, but can an attacker still find this directory? Is there some method to force a web server in listing files and directories? Does security through obscurity work in this case?
Note: I am on shared webhosting. I cannot control anything outside my htdocs folder and only have .htaccess available. All directories that contain PHP or template code have a
deny from all
in their .htaccess and other folders have an empty index.html along with
options -Indexes to avoid listing.