Details
Alert Id 10045
Alert Type Active
Status release
Risk High
CWE 541
WASC 34
Technologies Targeted All
Tags OWASP_2017_A06
OWASP_2021_A05
WSTG-V42-CONF-05

Summary

Predictable Resource Location is an attack technique used to uncover hidden web site content and functionality. By making educated guesses via brute forcing an attacker can guess file and directory names not intended for public viewing. Brute forcing filenames is easy because files/paths often have common naming convention and reside in standard locations. These can include temporary files, backup files, logs, administrative site sections, configuration files, demo applications, and sample files. These files may disclose sensitive information about the website, web application internals, database information, passwords, machine names, file paths to other sensitive areas, etc…

This will not only assist with identifying site surface which may lead to additional site vulnerabilities, but also may disclose valuable information to an attacker about the environment or its users. Predictable Resource Location is also known as Forced Browsing, Forceful Browsing, File Enumeration, and Directory Enumeration.

Solution

Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files. Consider using MVC based frameworks such as Struts.

Other Info

References

Code

org/zaproxy/zap/extension/ascanrules/SourceCodeDisclosureWebInfScanRule.java