Is it possible to bypass this .htaccess?

Is it possible to bypass this .htaccess? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Is it possible to bypass this .htaccess? (/showthread.php?tid=5920513)

Is it possible to bypass this .htaccess? - Mndz1414 - Dec 18, 2018

Code 
AuthName "Restricted Area"

AuthType Basic

AuthUserFile /home/xxx/.htpasswd

AuthGroupFile /dev/null 

require valid-user

Hi, I was trying instead of sending a "GET" a "GETS" to perform the bypass but it does not work. Should this be possible?

Thanks!

RE: Is it possible to bypass this .htaccess? - telmutraider - Dec 29, 2018

(Dec 18, 2018 11:25 PM)Mndz1414 Wrote:
Code
AuthName "Restricted Area" AuthType Basic AuthUserFile /home/xxx/.htpasswd AuthGroupFile /dev/null require valid-user

Hi, I was trying instead of sending a "GET" a "GETS" to perform the bypass but it does not work. Should this be possible?

Thanks!

No, it's protected by the Apache server which goes an checks the Linux OS for accounts on that Linux machine, and if it gets a user/password match it will only then let you through.

The weakness of AuthType Basic though is usually it allows unlimited retries. So you can use something like Hydra to try a million guesses. It would help if you knew or could narrow down the username though.