Authentication Bypass - htaccess exploitation

Authentication Bypass - htaccess exploitation - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Authentication Bypass - htaccess exploitation (/showthread.php?tid=6205972)

Authentication Bypass - htaccess exploitation - nerdy - May 18, 2022

htaccess exploitation

🤩 Here i will cover about a misconfiguration which many sysadmins make. 🤩

[1] BASIC MISCONFIG

It depends on how the htaccess is configured, many sysadmins commit misconfigurations and that leads to shit like this.

Example:

Code 
AuthUserFile /location/.htpasswd

AuthName "Restricted Area."

AuthType Basic

<Limit GET POST>

require valid-user

</Limit>

What's wrong here?
Problem comes at here:

Code 
<Limit GET POST>

require valid-user

</Limit>

It limits only for GET and POST requests. An attacker could use other requests like PUT and bypass it.
For example:

Code 
curl -X PUT targetLinkTo/protected-area

RE: Authentication Bypass - htaccess exploitation - weeboi - May 31, 2022

I think restriction bypass would be a more appropriate term, since this is commonly used to bypass 403 errors.

RE: Authentication Bypass - htaccess exploitation - linkinpork - May 31, 2022

(May 18, 2022 09:18 AM)nerdy Wrote: 🤩 Here i will cover about a misconfiguration which many sysadmins make. 🤩

This isn't authentication bypass.

Authentication bypass looks like this:

[Image: Gpd2P4I.png]

Here's OWASP's guide on Auth Bypass: https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication

RE: Authentication Bypass - htaccess exploitation - Exxxotic - Jun 2, 2022

(May 31, 2022 06:38 AM)weeboi Wrote: I think restriction bypass would be a more appropriate term, since this is commonly used to bypass 403 errors.

did you really just brute force this person that fast?!😳

RE: Authentication Bypass - htaccess exploitation - NS25 - Jul 7, 2022

Htaccess restriction bypass would be a more appropriate term for this

RE: Authentication Bypass - htaccess exploitation - Brief - Nov 14, 2022

How would one find "protected-area" (assuming it's a path or file)? In my knowledge, fuzzing those links requires GET request. Won't the requests to find the protected-area be blocked? Correct me if I am talking about something unrelated here. I don't even know what .htaccess is.