Ethical Hacker Community Forums

Hi,

I was going through IIS logs and and trying to figure out how hackers from the internet where able able find a directory/file that was hidden through obscurity.  I ran sensepost against the website and it indicates that the directories/site is not indexable.  So how did they find it.  The names were extremely uncommon. 

A friend with a great deal of experience tells me the indexing of website cannot be turned off and is part of the w3 standard. 

Any insight would be really appreciated.  I am really trying to figure out how this want found.  Thanks.

What do your logs show thus far?

Are there a bunch of requests like they were scanning for uncommon files?

GET /weirdname.htm
GET /weirdname2.htm
etc.

Was it simply accessed directly without any pre-attacks? Could it have been an inside job? Are there links anywhere on any of your pages that lead to these sites?

Indexing can be turned off, there is no standard to my knowledge which dictates that directory indexing must be enabled. Security by obscurity provides little in the way of protection.

If someone has accessed these 'hidden' files perhaps they knew the correct URL in the first place. Does the attacker try to guess the URL or do they go straight there?

Jimbob

Do you have the directory/file hidden from indexing using the robots.txt file?  Maybe they tried all the directories listed there?