News for hackers. Stuff that matters.

A comment on Robots.txt as a Security Measure?. Parent comment

Re:Robots.txt as a Security Measure? by sixplusone on Wednesday July 10, 2019 @09:35AM (#20401776)
As one small data point:

I've been running this experiment (another comment). While bots continuously hammer on port 22 (ssh), and repeatedly try to get things like /wp-* (I don't even run PHP), they don't bother fetching robots.txt in the first place, and my honeypot hasn't a single hit.

Definitely do not try to "secure" your site this way, but bots are either not sophisticated enough to analyze the .txt, or it might already be a known technique. Seems many other commenters come up with the same idea.

[ Parent | on HN ]
Re:Robots.txt as a Security Measure? by mjbmitch on Wednesday July 10, 2019 @01:32PM (#20404260)
If you're an adversary trying to snoop on port 22, why would you bother to respect the conventions of robot.txt to begin with?
[ Parent | on HN ]
Re:Robots.txt as a Security Measure? by sixplusone on Wednesday July 10, 2019 @02:21PM (#20404763)
Not necessarily the same bot. And they're not snooping so much as brute-forcing default/common/random(?) usernames & passwords.
[ Parent | on HN ]