[thelist] Can the Search Engines find an unlinked page?

Bob Meetin bobm at dottedi.biz
Sun Jul 13 15:51:10 CDT 2008

I visited the thread and site you note, but it looks like the writer 
must have already covered up this loophole - or I am missing something.  
I tried both the ?S=D and  ?M=A options on my site as well. It didn't 
reveal anything such as a file list and embarrass me =).  Does anyone 
have a test site where this can be verified, just curious?  -Bob

 evolt at brasscannon.net wrote:
> Quoth "Fred Jones" <fredthejonester at gmail.com>...
>> I made a demo site called somesite.com/fred/
>> There no link anywhere in the world to that page--in fact that only
>> people who ever saw it are me and my client. But he wants me now to
>> remove it because he says the search engines will find it and list it.
>> I am not opposed to removing it, but I think he's wrong. I see no way
>> for any search engine ever to find it. Am I wrong?
>> Perhaps since he and I use gmail, Google is reading our email and
>> thereby finds it?
> No, it's much more straightforward and honest, depending on 
> how your web server is configured.
> See: "How Google indexed a file with no external link"
>  http://seclists.org/bugtraq/2001/Jul/0174.html
>  Summary:
>  Apache 1.3.20 with Multiviews enabled allows remote requests to
>  view directory contents and bypass the index page via a URL
>  containing the "M=D" query string.
> See what you get if you ask for http://somesite.com/fred?M=D

More information about the thelist mailing list