Hidden Directory Detected

Question

My company web application had a penetration testing done and there's a risk found is regarding the hidden directory:

• http://example.com/aux/
• http://example.com/cgi-bin/
• http://example.com/com1/
• http://example.com/com2/
• http://example.com/com3/

I don't think there's any folder of that name in the application.

So, the question is where did all those folder come from? and how to mitigate this issue?

extra info: using Apache HTTP server on web server and Apache Tomcat on application server.

Answer 1

They are probably re-written addresses. Check your htaccess files and your website configuration files for rewrite rules or virtual directories.