3 ms·
Really doesn't leak much, and robot.txt is supposed to be accessible from the internet.
by m00x 4y ago
Really doesn't leak much, and robot.txt is supposed to be accessible from the internet.
- anonym29 4y agoYes, it's meant to be public, but you need not disclose all of what is contained inside of it. I've been on many pentests where paths provided by robots.txt, that I wouldn't have obtained any other way, led to exploitable vulnerabilities. For some reason, a considerable number of people don't seem to think twice about adding sensitive paths to robots.
- teknopaul 4y agoNot the case here tho is it
- anonym29 4y agoWell, we don't really know. Maybe there's some easy-to-guess text file in /misc/ that contains a password for something. We don't know what we don't know. We do know that there's considerably more information exposed here than zero - the question is whether any of that information could lead to sensitive information, not whether or not it constitutes sensitive information by itself.
- slim 4y agothat's defense in depth, right ? /s also sometimes what's in robots.txt becomes invisible to the corporation as well and abviously bugs creep in
- cuteboy19 4y agoI would rather that the paths be secure themselves. Security by obscurity is not a good idea. Anyways there are not that combinations of paths even when you consider all the different cms defaults
- anonym29 4y agoYou're correct that the resources themselves should be secured and that security through obscurity is a bad practice (and an oxymoron, as obscurity doesn't actually provide security). That said, avoiding security through obscurity doesn't preclude you from giving away less information than is being given away here, nor does it make the act of removing that information entirely pointless. While this isn't the only way that the Drupal version can be identified, it is one, and there's no guarantee your adversary will find it via other avenues. Also keep in mind that with absolutely nothing changing on Tesla's end, this may go from secure to vulnerable, should, for instance, a remotely exploitable vulnerability in the running version of Drupal be discovered and published in the future.
- hsbauauvhabzb 4y agoRobots.txt is a web standard, if it lists routes to actual sensitive data then hosing those sensitive paths is the issue, not robots.txt. I regularly see bad pentesters fall for this.