+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Webmasters (https://hackforums.net/forumdisplay.php?fid=141)
+---- Forum: Website Construction (https://hackforums.net/forumdisplay.php?fid=50)
+---- Thread: Bypassing .htpasswd? (/showthread.php?tid=5418489)
Bypassing .htpasswd? - Rushax - Sep 28, 2016
I have several dev sites for clients that are password protected using .htaccess combined with a .htpasswd file from the root/.htpasswd.
Is this enough security for it not to be accessible?
I've been looking around at several ways to bypass the .htpasswd using Live HTTP Headers and sending the request again as it says in this guide: https://www.hackthis.co.uk/forum/hacking-security/tutorials-articles/1159-bypassing-htaccesshtpasswd-based-authentication
However they've set the .htaccess up differently without the last line of
Code
require valid userThe .htaccess I have for blocking (with edits) is:
Code
ErrorDocument 401 "Denied"
ErrorDocument 403 "Denied"
# Allow plugin access to admin-ajax.php around password protection
<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>
AuthType Basic
AuthName "Secure Area"
AuthUserFile "/home/root/.htpasswds/.htpasswd"
require valid-userAll I want to find out is whether this method is secure enough?
~With the exception of using a bruteforce attack.