I am monitoring a webdav service that has been probed repeatedly since the beginning of February. The Apache 2.4 httpd server hosts just this one application. Access to the application is only possible over https and is controlled by an .htaccess file. Various directories in the web site directory tree are further restricted by an .htgroup file.
The probes have not actually retrieved any files. All attempts to GET result in a 401 Forbidden code. However, the probe is using actual file names found in the directory tree.
There is no ssh service to this host available except when explicitly manually enabled; and then only to internal private ip addresses.
My question is: what technique is/was used to discover the file names and directory structure? I have been trying to find a way to accomplish this and I cannot discover it. But clearly, there must be some way this information was obtained by the probing party.