Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If I configure an .htaccess file like this :
RewriteEngine On
RewriteRule ^([^/]*)$ /view.php?key=$1 [L]
Which transforms:
original URL http://www.example.com/view.php?key=123
rewritten URL http://www.example.com/123
Is there any way for an attacker to find the real PHP file (here view.php) and directly access it (in the URL bar)?
Considering URL-bruteforce is not an option, nor .htaccess reading.
There are several ways; php could have display_errors on or you could have HTML source or links that reveal the file location.
URL is a little trickier, but using something like ///view.php might do the job.
