1

The admin page is a page which allows me to access the database of my website. Of course, there will be a login screen there but I want to take measures that no one besides me will even ever see this page.

I'm using asp.net on a VPS.

So in my understanding, it should be sufficient to give the admin login page a complicated name so it can be accessed like this mysite.com/ie63xk...kig.aspx.

My question is: If I dissallow directory browsing and there is no link pointing to the hidden admin page, is there any way for a human / bot / search engine to locate this page?

2 Answers 2

4

If you disable directory browsing and ensure there are no links to your admin logon page then yes, people won't know about it. BUT this is a really unwise thing to rely on: security through obscurity. Access to this secret page can be discovered through your browser history, proxy logs, your web server logs. It can also be leaked out in the form of the referral header; lets say you have an external link on your secret admin page.

I would recommend focusing your efforts on securing your logon screen rather than stopping people knowing about it. If your username, password, and your login screen code is up to scratch it doesn't matter if somebody comes across it.

An additional layer of security that you could adopt would be to filter access to the logon screen to certain IP addresses. This is easily done in ASP.NET.

In summary, the answer to your question "is there any way for a human / bot / search engine to locate this page?" is no.

1
  • 1
    And of course, perform an authentication check on every admin page. Don't do what one client of mine did whereby they had a super secure admin logon screen (with one password, and an additional "pass phrase" per user) which simply redirected to /controlpanel.aspx if the credentials were good, and /badlogin.aspx if they were bad. But if someone bookmarked a certain admin page or entered the URL directly, they got free access ... doh! Sep 14, 2010 at 19:33
1

The normal way is to password protect the directories. So you will have another login just to see the page.

This will definitely secure the page from human/bot/search bot, probably best in vps to use forms authentication mode.

3
  • That would be protecting a login with another login so the first login could be spammed as well... What I want to know if is there is any way to reveal such a 'hidden' page without using brute force of course...
    – tom ruri
    Sep 14, 2010 at 14:59
  • 1
    Yes and no. Even if YOU have no link nowhere, some idiot admin may have a link on a hidden page somewhere that then gets parsed. Relying on this without login is asking fo a desaster. Point.
    – TomTom
    Sep 14, 2010 at 16:49
  • hmm don't know what your problem is guys... I clearly stated that I use a normal login on that page... I just want it to be invisible to the world as a second line of defense... I'm also the only one who will use the admin page... hope this clarifies some things :D Oh well, I'm not sure if you event meant me with your comment, TomTom
    – tom ruri
    Sep 14, 2010 at 17:50

You must log in to answer this question.