Intro to .htaccess password bypass

Adorapuff · 09-08-2014, 12:14 AM

+Reverence | Intro to .htaccess exploitation

Prerequisites:
Firefox
Live HTTP Headers
Account on http://ringzer0team.com

Tutorial:
Step 1: Go to ringzer0team.com/challenges/48
Step 2: Open Live HTTP Headers and make sure Capture is selected
Step 3: Click the first line so it looks like this

Spoiler:

Step 4: Click replay in the bottom left
Step 5: Change GET to anything but GET or POST
Step 6: Click replay
Step 7: Profit??

This works because the script that "secures" the .htaccess is limited to the GET & POST protocol as it is under the assumption that the user will not use any other request.

Seven · 09-08-2014, 12:23 AM

So this can lead into server side includes right?

Adorapuff · 09-08-2014, 12:24 AM

(09-08-2014, 12:20 AM)Seven Wrote: So what could you do with this?

Say you get the admin creds to a wordpress site, but they are only slightly stupid and try to secure their admin panel with an addition pass, they might implement a screen like such: http://howtofix.pro/tools/online/htbypass/index.php that needs to be passed in order to get to the WP login screen. Sometimes .htaccess is even used as the only protection on the admin panel.

Seven · 09-08-2014, 01:04 AM

(09-08-2014, 12:24 AM)Adorapuff Wrote: Say you get the admin creds to a wordpress site, but they are only slightly stupid and try to secure their admin panel with an addition pass, they might implement a screen like such: http://howtofix.pro/tools/online/htbypass/index.php that needs to be passed in order to get to the WP login screen. Sometimes .htaccess is even used as the only protection on the admin panel.

I see. Do you know if this would work on stuff like cameras and routers. I know my routers webapp has a panel like this.

Adorapuff · 09-08-2014, 01:06 AM

(09-08-2014, 01:04 AM)Seven Wrote: I see. Do you know if this would work on stuff like cameras and routers. I know my routers webapp has a panel like this.

Depends on if they are vulnerable :p try it out on your router if you like Smile

Seven · 09-08-2014, 01:11 AM

(09-08-2014, 01:06 AM)Adorapuff Wrote: Depends on if they are vulnerable :p try it out on your router if you like

Well if it is I can confirm that old rogers distributed routers are vulnerable Biggrin

Krypt · 09-18-2014, 03:38 AM

Wow this is really nice man, will be able to check this out properly when I'm actually at my computer. Good job.