3 ms·
>Randomizing variable names it just a nuisance, it won't stop any competent pen tester or attacker. Sure it will. Imagine that your old, unpatched Wordpress ad
by drchopchop 6y ago
>Randomizing variable names it just a nuisance, it won't stop any competent pen tester or attacker.
Sure it will. Imagine that your old, unpatched Wordpress admin is at /random-gobbledygook instead of /wp-admin. An attacker would have to try to hit random alphanumeric directories of your webserver over and over again, hoping that he stumbles across a specific thing that they can attack. This is completely impractical, unless they're somehow clued in that the URL exists.
It's really about making life difficult for an attacker, so much so that they will simply give up, or find an easier target. That can be achieved by throwing up a series of difficult/obscure barriers, each which makes it less likely you'll be trivially penetrated.
- scarface74 6y agoOne of the first widespread security vulnerabilities I had to deal with was this one: https://www.giac.org/paper/gcih/115/iis-unicode-exploit/101163 https://www.giac.org/paper/gcih/115/iis-unicode-exploit/1011... You could basically encode DOS commands in the URL bar for a site running IIS and it would run remotely. The automated attack basically replaced the index.html pages. But if you didn’t use the default pages. It didn’t have any effect.
- mncharity 6y agoI ran a world-writable off-the-shelf wiki for years. Trivially tweaked the edit url, visible on every page. But that was enough to break automated spam tooling defaults, so the spamming human might get to see a note, pointing out that robots.txt was blocking indexing, so there was really no reason to waste both our times. The dominant threat wasn't the spammer, but their dumb automation.