0

I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack or access. So what i want to know is how to prevent such things from happening, to stop the attack before it can occur.

Because in OWASP Juice Shop, it is seen that the ftp directory of the site can be enumerated via DirB, so what are some recommendations to take to prevent such things from happening? And what are the risks of such attacks?

| improve this question | | | | |
1

What does such an attack look like? Consider what you are able to see as the server administrator. A DirB/DirBuster attack makes requests for numerous webpages, many of which won't exist. The observable result: lots of 404 HTTP responses for the pages that don't exist. These errors will typically appear in the webserver's access logs.

There are a number of tools out there that can take actions based on log activity. A common one is Fail2Ban, which can be configured to temporarily ban a remote IP address with firewall rules if it generates too many 404s within a time period. But this may not be necessary; see the next paragraph.

What is the risk? If your site and server are configured properly and secured with proper access controls, there should be nothing to worry about. Typically, an attacker scans for directories/files for information gathering/enumeration purposes. Perhaps there are paths that are unpublished, relying on "security through obscurity", i.e. simply hoping the adversary will not find these "hidden' web paths, in this case. Or, there may be files unintentionally left/visible in the webroot, such as text/config files with sensitive information.

So, if you have nothing to hide, and aren't running vulnerable/misconfigured software (those are some big IFs), brute forcing files and directories isn't a huge risk.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.