[nerdy]

htaccess exploitation

🤩 Here i will cover about a misconfiguration which many sysadmins make. 🤩

[1] BASIC MISCONFIG

It depends on how the htaccess is configured, many sysadmins commit misconfigurations and that leads to shit like this.

Example:

Code

AuthUserFile /location/.htpasswd
AuthName "Restricted Area."
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>

What's wrong here?
Problem comes at here:

Code

<Limit GET POST>
require valid-user
</Limit>

It limits only for GET and POST requests. An attacker could use other requests like PUT and bypass it.
For example:

Code

curl -X PUT targetLinkTo/protected-area

[weeboi]

I think restriction bypass would be a more appropriate term, since this is commonly used to bypass 403 errors.

[linkinpork]

🤩 Here i will cover about a misconfiguration which many sysadmins make. 🤩

This isn't authentication bypass.

Authentication bypass looks like this:



Here's OWASP's guide on Auth Bypass: https://owasp.org/www-project-top-ten/20...entication

[Exxxotic]

I think restriction bypass would be a more appropriate term, since this is commonly used to bypass 403 errors.

did you really just brute force this person that fast?!😳

[NS25]

Htaccess restriction bypass would be a more appropriate term for this

[Brief]

How would one find "protected-area" (assuming it's a path or file)? In my knowledge, fuzzing those links requires GET request. Won't the requests to find the protected-area be blocked? Correct me if I am talking about something unrelated here. I don't even know what .htaccess is.