2

I have deployed a php project on apache. When I use DirBuster tool to scan my site, it lists all server side files. I want to stop this listing.

I have modified the permission. When I give the less permissions, which are necessary to open site on browser, DirBuster still lists the files. When I provide less than these permissions, it stops listing file using DirBuster but I am not able to see the site on browser, it shows access forbidden error.

Please suggest me a way to prevent file listing by this tool but site should be running smoothly on the browser.

Improve this question
5
  • 2
    This is not possible and your approach seems incorrect to me. Why would you want to hide your files? Make sure that if Dirbuster discover these files that an attacker can't tamper with them. Security by obscurity is not the way to go in my opinion.
    – Jeroen
    Commented May 11, 2016 at 5:24
  • Directory listing can typically be prevented by creating an empty file called index.html in the directory or by disabling it in the web server config.
    – wireghoul
    Commented May 11, 2016 at 5:33
  • OP probably doesn't have directory listing enabled. DirBuster guesses the filenames. @derek: you can either include a random string in all of your filenames or just deal with it. If your webserver is properly configured, this isn't a security issue. The php interpreter should prevent the delivery of the contents of the php files.
    – Volker
    Commented May 11, 2016 at 7:09
  • Thank you for your comments. Yes, directory listing is disabled on the server. User can not see the files of a folder in browser but if anyone uses this tool, one can get list of all files.
    – Derek
    Commented May 11, 2016 at 9:20
  • I'm voting to close this question as off-topic because you're asking how to hide files on Apache httpd, which is product support and belongs on either serverfault, superuser, or perhaps you should contact someone from Apache. Or you could, like, read the documentation.
    – Luc
    Commented Sep 19, 2019 at 9:38

4 Answers 4

Reset to default
5

There are a few ways to stop this, but they aren't always recommended.

The first option is to go through all your files, with something like sed, and append all href links with a random string and then rename all the files with that string... Basically, quickly change all names to like "randomstringfile.txt" instead of "file.txt". This can make it hard to find the files for normal people who memorize websites though.

Also you could make rules in your server to block people for a set amount of time if they request more than 100 requests in a minute or something. This breaks it severely, but not forever. A permanent ban isn't suggested, but not the worst idea either. Sort of like password guess limitations that lock you out for 5 minutes.

A final option is to break any dirbuster-like useragent. This won't stop people who understand, but will break script-kiddies, and automated scans people don't monitor.

Improve this answer
3

Dirbuster works by analyzing the HTTP response codes and that's why it can sometimes predict the existance of files even if it does not have permissions to access them. That works because often you will get a 403 (forbidden) response, or some similar response code for files that you do not have permissions to access, but you will get a 404 code for files that do not exist. That means, your application should simply return a 404 code for files that you do not want Dirbuster to find. How exactly you will do that highly depends on the design of your application.

Improve this answer
-1

It is not possible to prevent a client like DirBuster to access URLs that a standard web browser can smoothly access.

Improve this answer
3
  • If a browser can access the file, there is no way to block a client like DirBuster! The accepted answer suggest to change the filenames, in that way is less probably that the randomized filename is already included in one of the filename list on the Internet, but this is different from preventing the client to access the file. The same goes for limiting the requests, that's if, you can recognize the same actor. That said, if an attacker guess the randomized filename (bruteforcing the URL) there is absolutely no way to block it.
    – frenkie
    Commented Jan 12, 2021 at 13:40
  • The accepted answer also discusses user-agent strings and request limiting and banning unacceptable requests. So, yes, it is possible to "prevent a client like DirBuster". It does not prevent all types of requests, but it can block the tools.
    – schroeder ♦
    Commented Jan 12, 2021 at 13:55
  • It can block A tool, as long as you know its user agent (that can be easily modified in modern web path scanners anyway). It can't block "clents like DirBuster".
    – frenkie
    Commented Jan 12, 2021 at 14:01
-2

Limit the number of requests from an IP, also you can limit the number of requests within a time interval.

Improve this answer
2
  • what if the scan is throttled?
    – schroeder ♦
    Commented May 25, 2017 at 6:59
  • Truthfully anyone willing to wait for 220k requests (not to mention it is exponential for each folder) and limit it to once per minute or something is so patient, they deserve the find
    – Robert Cotterman
    Commented Sep 19, 2019 at 5:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .