Is it possible to determine that a page actually exists when it is designed to throw a
404 NOT FOUND?
On my server, when a request to a script is made while passing invalid parameters, I am throwing a 404 http status code because I don't want those with no knowledge of the system to know the page (public URL) exists. I am hoping that throwing a 404 will make an attacker think the script does not exist. No resources on the server itself actually direct to the script, it would all be from external requests.
What I really want to know is, from just the response, would someone be able to tell the difference between a page that does not exist and a page configured to return a 404?
The response headers when making an invalid request to the script do indicate a http status of 404, and not a http status of 200 with a 404 page displayed.
Below is the response header I am getting when I make an invalid request.
HTTP/1.1 404 Not Found Date: Fri, 27 Jan 2017 23:32:28 GMT Server: Apache X-Frame-Options: SAMEORIGIN X-Powered-By: PHP/5.4.16 X-XSS-Protection: 1; mode=block Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
EDIT: Below is the response header I am getting when I hit a page that truly does not exist.
HTTP/1.1 404 Not Found Date: Tue, 31 Jan 2017 19:08:06 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 203 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1