HTTP Dictionary Attacks

ALTERNATIVE NAMES

Dictionary Brute Forcing, Directory Harvesting

AFFECTED SYSTEMS

All systems are potentially vulnerable to gathering a site map of the site.

SEVERITY

Low

BACKGROUND

It was a common measure for the developers to auto-generate file list as an index page by using web servers functionality. Nowadays it is a bad idea to enable directory browsing. When developers stop using directory browsing feature, attackers start using dictionary attacks to find out possible directory names on the server by using a list of words available in a directory.

DESCRIPTION

An attacker may reveal directory names publicly available on the victim site. Directory names can be revealed by brute-forcing for folder names by using a list of words available in the directory.

ANALYSIS

HTTP Dictionary Attacks can be made by trivial brute force scripts or services by using a dictionary of words as a source for directory names to check for. It is nothing but having a list of directory names will clear the pathway to attack surface, this will reduce the number of attacks.

SOLUTION

If you are using a WAF or IDS/IPS system you can set the maximum number of requests made by a client at a certain amount time. The double of the average requests of every page on the server is a reasonable value.

LEGAL

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.