0

I'm building a website using Laravel and I'm just thinking about security.

I would like to know if there is a way for attacker to detect all active web routes for a website ?

For example:

http://example.com/login
http://example.com/products
http://example.com/products/{id}/items
etc...

So, what techniques will attacker use to detect this routes ?

Will he check the website page source and search for links or will he somehow try to detect those links without looking at page source code (brute-force for example).

To be honest, I'm asking because I'm not sure if should put the link to the Content Manager to my homepage or not...

1

It depends on the application. They could start with a sitemap like one you provide Google. Or they could crawl it and extract links like a search engine would.

In your case if {id} is a sequential number, they might do a simple enumeration attack. Here's a high profile case where that lead to sensitive information disclosure because of poor access control mechanisms.

Last, they could just guess. For example, every web server I run gets attempts to login to the wordpress admin panel. Which is funny for me because I don't run any wordpress sites... not so funny for wordpress users who didn't set a good password.

0

u can using:

  1. dirbuster
  2. gobuster
  3. dirb
  4. nikto
  5. wfuzz
  6. BurpSuite"webspider options"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.