Mini-vulnerability
I wouldn't really call it a vulnerability, but more like a way for people to gain information about our forum and see different forums for them to try to exploit.
First, go to any of these links.
and now try this link:
The "trash bin" link doesn't exist. See how you can tell what forums do and don't exist, even if you don't have access to them?
This is just an example using the trash forum, but say they wanted to find the name of our admin forums because of some kewl neu exploeet.
All they would have to do is see which pages return the "You don't have permission" page, and which return our custom 404 page.
I think we should make forums that users don't have access to redirect to our 404 page instead, just to be safe.
Like I said before though, this is just a thought, it's not like we're going to get hacked because of it or something lol. Just increasing overall site security.
What do you guys think?
First, go to any of these links.
http://forum.logicalgamers.com/donators/
http://forum.logicalgamers.com/moderators/
http://forum.logicalgamers.com/administrators/
http://forum.logicalgamers.com/recycle-bin/and now try this link:
http://forum.logicalgamers.com/trash-bin/The "trash bin" link doesn't exist. See how you can tell what forums do and don't exist, even if you don't have access to them?
This is just an example using the trash forum, but say they wanted to find the name of our admin forums because of some kewl neu exploeet.
All they would have to do is see which pages return the "You don't have permission" page, and which return our custom 404 page.
I think we should make forums that users don't have access to redirect to our 404 page instead, just to be safe.
Like I said before though, this is just a thought, it's not like we're going to get hacked because of it or something lol. Just increasing overall site security.
What do you guys think?
