I see you're looking for information on a specific topic.
Attackers use search engine hacking, known as Google Dorking, to find these vulnerabilities. Search engines index public directories automatically if they are not explicitly blocked. An attacker might use these specific search strings: index of password txt link
Index of /private