While you are correct, you can use the stock behavior of most web servers like Apache or IIS to evade this attempt at misinformation and learn whether something

While you are correct, you can use the stock behavior of most web servers like Apache or IIS to evade this attempt at misinformation and learn whether something really exists or not. Lets say /admin/ is a directory that exists on the site, but I am not authorized to access it. So site returns a 403 or, if you are sneaky and don't want to reveal the existence /admin/ to unauthorized users, you configured the server to return 404. Go ahead a send a GET request for just /admin without the trailing slash. Assuming there isn't actually a file named "admin" and admin is actually a directory, by default most versions of Apache/IIS will return a 302 direct to /admin/. This reveals the existence of the directory, regardless of what status code you get when fetching /admin/. I'm not sure the exactly why web servers behave this way. My educated guess is that when Apache/IIS service the request, they see the named entity is actually a directory, so there is no content to return. So they redirect you into the directory, so that either the directory contents can be displayed, or a default document can be sent instead. Years ago, I worked on a web brute forcer which used this method to detect the existence of directories. The advantage is slightly more limited now with the rise of MVC where the entire path of a URL doesn't directly map to a file system path.