1

If I configure an .htaccess file like this :

RewriteEngine On
RewriteRule ^([^/]*)$ /view.php?key=$1 [L]

Which transforms:

original URL   http://www.example.com/view.php?key=123
rewritten URL  http://www.example.com/123

Is there any way for an attacker to find the real PHP file (here view.php) and directly access it (in the URL bar)? Considering URL-bruteforce is not an option, nor .htaccess reading.

MrWhite
  • 294
  • 1
  • 2
  • 15
Jeremy
  • 91
  • 8

1 Answers1

1

There are several ways; php could have display_errors on or you could have HTML source or links that reveal the file location.

URL is a little trickier, but using something like ///view.php might do the job.

wireghoul
  • 5,745
  • 2
  • 17
  • 26