1

I have a library inside my webroot:

https://my-website.com/wp-content/my-library-i-want-to-hide

Accessing the url via a browser gives me the expected permission denied error. However, I want to make sure that that clients don't even know the library exists.

The solution I thought of was just renaming the library to a random string. So, my the url to my library now looks something like this:

https://my-website.com/wp-content/asdasdas2232asd12890310283ß12

Is there any way for an attacker, without access to my server, to identify that such folder exists on my webserver and if yes, what's the best way to hide the folder?

Thank you very much!

Improve this question
1
  • 1
    Using random names for web directories just makes it harder to brute force them, but if your application uses it somehow then it might (that depends on how your application is organized) be possible to find it easily using a e.g. HTTP proxy and observing the traffic.
    – game0ver
    Jul 5, 2018 at 19:46

1 Answer 1

Reset to default
1

This is probably going to be dependent on what server you're running and on which OS but this is one example of how to handle it.

You can capture the error response and send them to another page instead of returning error codes.

If I were implementing this I would send all errors to your index page. That way the attacker doesn't know if something's restricted, not there, broken etc. This also makes bruteforce scanning with dirb dirbuster and wfuzz a pain as they leverage response codes to identify pages. So if you always return a 200 status code then you effectively break using those tools.

Custom error documents are configured using the ErrorDocument directive, which may be used in global, virtualhost, or directory context. It may be used in .htaccess files if AllowOverride is set to FileInfo.

- ErrorDocument 500 "Sorry, our script crashed. Oh dear"
- ErrorDocument 500 /cgi-bin/crash-recover
- ErrorDocument 500 http://error.example.com/server_error.html
- ErrorDocument 404 /errors/not_found.html
- ErrorDocument 401 /subscription/how_to_subscribe.html

The syntax of the ErrorDocument directive is: ErrorDocument <3-digit-code> where the action will be treated as: A local URL to redirect to (if the action begins with a "/").

An external URL to redirect to (if the action is a valid URL). Text to be displayed (if none of the above). The text must be wrapped in quotes (") if it consists of more than one word.

When redirecting to a local URL, additional environment variables are set so that the response can be further customized. They are not sent to external URLs.

For more information check out the documentation

https://httpd.apache.org/docs/2.4/custom-error.html

This is not a fix all for web bruteforcing. I wrote a script not long ago that leverages content length instead of status code. You can see how it works on GitHub

To defeat content length scanners I'd probably just include a hidden random string with a variable length in my index or error page.

Improve this answer
3
  • 1
    @TimvonKänel if this works for you don't forget to checkmark it so people know it's answered
    – DotNetRussell
    Jul 5, 2018 at 20:27
  • So you would basically show the same error code to the visitor for pages which dont have permissions and for pages which dont exist?
    – Tim von Känel
    Jul 5, 2018 at 20:30
  • 1
    If you wanted to do it the professional way, you'd either show them a custom error page that's the same no matter what and directs them to contact admins if it keeps happening. I personally would just dump all errors back to the index page though. It's way more effective.
    – DotNetRussell
    Jul 5, 2018 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .