I came across http://test.co.uk/img/rOTJwSOqWzHaDsEUcHhI.

If we take a look at it the directory space is protected against bruteforcing of the whole directory to explore private images.

I don't know the official name for this and want to implement it on my own domain, is there an official paper for to do this?

  • 1
    I searched on owasp but still nothing – lmms Sep 20 '19 at 13:47
  • 2
    It looks like you mean a "private URL", i.e. a URL which can not be guessed. I doubt that there is a paper for this since the idea is trivial and basically the same as a password: have something which others don't know, cannot guess and which is hard enough to brute force. "... want to implement it on my own domain..." - There is nothing special about this. Simply create a directory with a complex name and make sure that nobody can figure out the name (i.e. don't enable directory index in the parent directory). – Steffen Ullrich Sep 20 '19 at 13:59
  • 1
    @Steffen Ullrich Thanks, this must be possible – lmms Sep 20 '19 at 14:10

Depending on your server, you might be able to disable "directory indexing", which means a person can't list out the contents of the directory. Alternatively, you can place the private images outside the document root. Create the url with a token. For the image request, use the token to look up the real image location and provide the real image.

If the token is something easily guessed, your attacker can still find the images. For example, if you use simple number like 1, 2, 3, 4, 5, I could easily guess that 6 might be a valid token.

If you use a hard-to-guess directory name, but include that in the url, that hard-to-guess name is now known.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.