9

I'm working on a site that doesn't need to be known to the Internet at large (but for a few reasons, is hosted on shared hosting instead of on an intranet). It's a WordPress installation and so I've set it up to discourage search engines and be fully password-protected.

I'm now looking at how I can harden it a bit more. But if it's not listed on major search engines and nothing is linking to it, then what are the chances of a botnet or some kind of random malicious site finding it anyways?

Which leads me to my question. How do random malicious attackers find websites to prey on? I figured search engines and links from other sites, but are there any other ways? While I doubt that there's a one-size-fits-all answer, I'm sure there are general areas to watch out for...

Improve this question
3
  • 5
    You might find this question and its answers an interesting read. But don't forget about referer fingerprints that you might be leaving on other web servers, if you'll be referring to external resources (images, videos, external URLs, external JavaScripts,...) on your WP webpages, and don't depend on third-party anonymizers for that task either.
    – TildalWave
    Apr 16, 2013 at 22:41
  • 2
    nmap -Pn -sS -p 80 -iR 0 --open can be used to while away a rainy day. It will location web servers based on random IP address generation.
    – lynks
    Apr 17, 2013 at 17:18
  • Google. There a ton of queries that can find unsecured networks, servers with default settings, etc.
    – drunkenRabbit
    Apr 17, 2013 at 18:07

7 Answers 7

Reset to default
7

There's a variety of ways that people can discover a site.

  • links might get placed on social networking sites (e.g. twitter, facebook)
  • search engines like Shodan might find the content
  • ...

So as the other answers mention, it's easiest to assume that it's discoverable. One thing that's not been mentioned that I'd recommend to protect a site if it only needs to be accessed by people within your organisation is that you could use .htaccess files to restrict access to the site to only specific source IP addresses (assuming that your company has fixed external IP addresses, which most will).

there's a number of articles on the details of doing this one example here

Improve this answer
3
  • Thanks for your answer! Any other ways than the two you mentioned?
    – Brendan
    Apr 16, 2013 at 21:18
  • well there's the standard "scanning port 80 on a range of IP addresses", but I'd say that direct scanning, search engine invclusion (e.g. shodan) and accidental leakage of information on the site would be the main 3
    – Rory McCune
    Apr 17, 2013 at 17:42
  • One of our clients had a "secret website", whose URL was only given to preferred customers. It only took one of those preferred customers giving away the URL to reveal it to the world.
    – Jay
    Mar 14, 2016 at 4:13
7

Assume every malicious person already has the URL of your website. Actually, to be thorough, assume they have every URL on your website. Having a "hidden" "private" website is no more an actual security measure than having "hidden" directories. To assume otherwise is folly.

Improve this answer
2
  • @DavidStratton To be fair, I edited the title after this post :)
    – Brendan
    Apr 16, 2013 at 21:17
  • Well, then I withdraw my objection and vote this up for being good advice. This does answer the original title perfectly. ;-)
    – David Stratton
    Apr 16, 2013 at 21:29
4

In addition to the ways you listed, here are a couple more:

  • IPv4 space is limited. It is feasible to scan random (or sequential) IP addresses for web servers that are open and vulnerable. This will not work for virtual hosts (where the HTTP Host header determines which site to serve).
  • Domain registration data is public. Attackers could run through feed a list of registered domains to a scanner, though the majority would be unused and parked.
  • Online services like RobTex can be used to find lists of domains and hostnames that resolve to an IP address. They get this from regular DNS lookups, and the information could be used to find sites that are hosted at a particular provider, for example.
Improve this answer
4

I'm working on a site that doesn't need to be known to the Internet at large

Can you expand on your reason? If access should be limited, you may want to consider hosting it on a non-Internet server connected over a VPN. Using even some free commercial tool like TeamViewer you could setup your own little VPN. If it's just for testing, you should consider a local server, virtual machine, raspberry pi server, or another pc on your LAN.

Anonymity concerns for a Wordpress on a Shared Server, that is password protected

  • First, wordpress is a very popular software and can easily be fingerprinted. If you know some common URLS, comments, etc. then you can find WordPress sites.
  • There are a few different ways a server can be found. A web spider may just find you by indexing you, hoping links, etc. Just because you don't want the site to be generally available doesn't mean someone else doesn't want to provide a link.
  • In addition, if you link to any other site on the Internet and someone clicks a link from your site, your site will show up as the referring website and then you can be indexed, logged, found. Even a link in a web based email account can show up as a referrer. Web services or plugins you use may also expose your site.
  • If you have happened to register a domain name for your site, that is a public record. Even if you used a proxy service to hide you identity, people can still see the site was added.
  • You need to harden a wordpress site and make sure you remove stuff you don't need, update patches, change defaults, etc.

Anonymity concerns for a Wordpress on a Shared Server, that is password protected

  • A shared server is generally weak because a lot of people are running apps on it, this can expose you to being found and to security flaws with poor configurations or poor security controls
  • Shared Servers are also not patched as regularly because they don't want to have a lot of customers complaining about upgrades breaking functionality, this could also lead to enumerating the hosts and their details

Anonymity concerns for a Wordpress on a Shared Server, that is password protected

Password protected can be loaded statement. Do you mean you have a password on the admin page, on every page - even the normal blog pages? Where is the password protection, HTTP basic auth, a session based form logon once the page loads? Just because a password is requested, that won't hide a website, it may protect access, but won't hide is presence because you are getting a status message which indicates it is there.

If you want to block access and make it seem that your site is not available, and you are running on apache, you may want to consider allowing only a limited number of IP addresses and sending all others to a 404 or other redirect to block access before the page is even loaded:

ErrorDocument 403 http://www.your-ip-is-not-allowed.com
Order deny,allow
Deny from all
Allow from **X.X.X.X**

 

ErrorDocument 404 http://www.aol.com

You could redirect to page which indicates the site is down for everyone you do not explicitly allow.

If you give enough monkies IE6, eventually they will type in some letters or number which bring up your site.

Improve this answer
3

I suppose your site uses HTTPS. If it does not, do it now.

Now that your site uses HTTPS, you can use a "private path": make the root URL for the site look like: https://www.yourserver.com/hjgw478fsu3b/index.html. The hjgw478fsu3b is the "private part". It will be sent only through the SSL tunnel, so it acts as a kind of key.

For users of the site, it suffices to have a bookmark in their browser, linking to the site, so they don't have to type it again and again, or even remember it.

With such a private path element, your site will remain unknown to "random attackers" until:

  • the bookmarks of one of the users are stolen by some malware on his machine
  • the server itself gets hacked into, through another service hosted on the same machine
  • a user laptop/iPhone/iPad is stolen altogether and the thief looks at the data

whichever happens first.

Improve this answer
2
  • Doesn't he already have his "private path" by using authentication on every page, so all an attacker will see is HTTP 401 status codes no matter what page he visits. He'd still have to use SSL to keep the credentials safe. Though when he said "fully password protected", he have been talking about application passwords rather than HTTP basic authentication.
    – Johnny
    Apr 16, 2013 at 22:25
  • 1
    It depends on how the authentication is done. If it is done with 401 status codes, then the browser will display the login+password popup. Most Web sites don't work that way; instead, they have their own login+password page, and that page (and what it references) is necessarily reachable without authentication.
    – Thomas Pornin
    Apr 16, 2013 at 22:51
3

If you have links to other sites then your secret site will show up as the referrer in another site's logs, which can appear publicly in many ways.

Improve this answer
2

A bad guy can find a list of domain names or create a program to start finding them. That program might create all strings or use a wordlist. Many two word phrases are domain names.

If fact, since most public ipv4 address are already in use, someone could write a program to find out what kind of devices are at each ip address and what services are running.

Then create or use an existing program to gather information about the list of websites. In this list they would note particular vulnerabilities (version numbers) of devices and services. After enough data has been collected, another program would be able to craft an attack on all those websites with public vulnerabilities or with 0-day vulnerabilities.

Potentially you can not have a dns name for your IP, and perhaps you can use an ipv6 address and instead of ipv4 since an ipv6 address would be almost impossible to guess.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .