2

I have deployed a php project on apache. When I use DirBuster tool to scan my site, it lists all server side files. I want to stop this listing.

I have modified the permission. When I give the less permissions, which are necessary to open site on browser, DirBuster still lists the files. When I provide less than these permissions, it stops listing file using DirBuster but I am not able to see the site on browser, it shows access forbidden error.

Please suggest me a way to prevent file listing by this tool but site should be running smoothly on the browser.

  • 1
    This is not possible and your approach seems incorrect to me. Why would you want to hide your files? Make sure that if Dirbuster discover these files that an attacker can't tamper with them. Security by obscurity is not the way to go in my opinion. – Jeroen May 11 '16 at 5:24
  • Directory listing can typically be prevented by creating an empty file called index.html in the directory or by disabling it in the web server config. – wireghoul May 11 '16 at 5:33
  • OP probably doesn't have directory listing enabled. DirBuster guesses the filenames. @derek: you can either include a random string in all of your filenames or just deal with it. If your webserver is properly configured, this isn't a security issue. The php interpreter should prevent the delivery of the contents of the php files. – Volker May 11 '16 at 7:09
  • Thank you for your comments. Yes, directory listing is disabled on the server. User can not see the files of a folder in browser but if anyone uses this tool, one can get list of all files. – Derek May 11 '16 at 9:20
  • I'm voting to close this question as off-topic because you're asking how to hide files on Apache httpd, which is product support and belongs on either serverfault, superuser, or perhaps you should contact someone from Apache. Or you could, like, read the documentation. – Luc Sep 19 '19 at 9:38
3

There are a few ways to stop this, but they aren't always recommended.

The first option is to go through all your files, with something like sed, and append all href links with a random string and then rename all the files with that string... Basically, quickly change all names to like "randomstringfile.txt" instead of "file.txt". This can make it hard to find the files for normal people who memorize websites though.

Also you could make rules in your server to block people for a set amount of time if they request more than 100 requests in a minute or something. This breaks it severely, but not forever. A permanent ban isn't suggested, but not the worst idea either. Sort of like password guess limitations that lock you out for 5 minutes.

A final option is to break any dirbuster-like useragent. This won't stop people who understand, but will break script-kiddies, and automated scans people don't monitor.

2

Dirbuster works by analyzing the HTTP response codes and that's why it can sometimes predict the existance of files even if it does not have permissions to access them. That works because often you will get a 403 (forbidden) response, or some similar response code for files that you do not have permissions to access, but you will get a 404 code for files that do not exist. That means, your application should simply return a 404 code for files that you do not want Dirbuster to find. How exactly you will do that highly depends on the design of your application.

-2

Limit the number of requests from an IP, also you can limit the number of requests within a time interval.

  • what if the scan is throttled? – schroeder May 25 '17 at 6:59
  • Truthfully anyone willing to wait for 220k requests (not to mention it is exponential for each folder) and limit it to once per minute or something is so patient, they deserve the find – Robert Cotterman Sep 19 '19 at 5:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.