Hi,

I was going through IIS logs and and trying to figure out how hackers from the internet where able able find a directory/file that was hidden through obscurity.  I ran sensepost against the website and it indicates that the directories/site is not indexable.  So how did they find it.  The names were extremely uncommon. 

A friend with a great deal of experience tells me the indexing of website cannot be turned off and is part of the w3 standard. 

Any insight would be really appreciated.  I am really trying to figure out how this want found.  Thanks.

Indexing can be turned off, there is no standard to my knowledge which dictates that directory indexing must be enabled. Security by obscurity provides little in the way of protection.

If someone has accessed these 'hidden' files perhaps they knew the correct URL in the first place. Does the attacker try to guess the URL or do they go straight there?

Jimbob