Is it possible to determine that a page actually exists when it is designed to throw a 404 NOT FOUND
?
On my server, when a request to a script is made while passing invalid parameters, I am throwing a 404 http status code because I don't want those with no knowledge of the system to know the page (public URL) exists. I am hoping that throwing a 404 will make an attacker think the script does not exist. No resources on the server itself actually direct to the script, it would all be from external requests.
What I really want to know is, from just the response, would someone be able to tell the difference between a page that does not exist and a page configured to return a 404?
The response headers when making an invalid request to the script do indicate a http status of 404, and not a http status of 200 with a 404 page displayed.
Below is the response header I am getting when I make an invalid request.
HTTP/1.1 404 Not Found
Date: Fri, 27 Jan 2017 23:32:28 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-Powered-By: PHP/5.4.16
X-XSS-Protection: 1; mode=block
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
EDIT: Below is the response header I am getting when I hit a page that truly does not exist.
HTTP/1.1 404 Not Found
Date: Tue, 31 Jan 2017 19:08:06 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Length: 203
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
X-Powered-By: PHP/5.4.16
might be a hint. Does it exist for truely missing pages? Maybe you could add a response got for a truely missing page in your question.