+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: accessing forbidden URLs (/showthread.php?tid=6012637)
accessing forbidden URLs - roosiinfidel09 - Oct 1, 2019
One of the tricks I read about is adding random numbers and letters followed by /../ takes you to the previous directory. My question is are there any tricks for accessing URLs disallowed in robots.txt? like /users/password/
Also, how many times do you add the "/../" ..just once or multiple times?
RE: accessing forbidden URLs - CyberStrike - Oct 1, 2019
Directory traversal - https://www.owasp.org/index.php/Path_Traversal
URL's disallowed in robots.txt are just not supposed to be indexed by the spidering bots of google or whatever search engine. Read more here :
https://support.google.com/webmasters/answer/6062608?hl=en
When you say forbidden I think of 403 errors, is that what you are facing.
RE: accessing forbidden URLs - roosiinfidel09 - Oct 1, 2019
(Oct 1, 2019 02:08 AM)CyberStrike Wrote: Directory traversal - Path Traversal - OWASP
URL's disallowed in robots.txt are just not supposed to be indexed by the spidering bots of google or whatever search engine. Read more here :
Introduction to robots.txt - Search Console Help
When you say forbidden I think of 403 errors, is that what you are facing.
In that case..I should be able to browse these pages. However, I am not. So, some other measure has been taken by the admin? I visit bex.rs/admin ..just shows a blank page..No erros..Run it through burp ..it shows connection timed out.
http://www.bex.rs/robots.txt
RE: accessing forbidden URLs - CyberStrike - Oct 1, 2019
(Oct 1, 2019 02:53 AM)roosiinfidel09 Wrote: In that case..I should be able to browse these pages. However, I am not. So, some other measure has been taken by the admin? I visit bex.rs/admin ..just shows a blank page..No erros..Run it through burp ..it shows connection timed out.
http://www.bex.rs/robots.txt
maybe they have a WAF? Perhaps ACLs?