+Reverence | Intro to .htaccess exploitation

Prerequisites:
Firefox
Live HTTP Headers
Account on http://ringzer0team.com

Tutorial:
Step 1: Go to ringzer0team.com/challenges/48
Step 2: Open Live HTTP Headers and make sure Capture is selected
Step 3: Click the first line so it looks like this

Spoiler:

Step 4: Click replay in the bottom left
Step 5: Change GET to anything but GET or POST
Step 6: Click replay
Step 7: Profit??

This works because the script that "secures" the .htaccess is limited to the GET & POST protocol as it is under the assumption that the user will not use any other request.

(09-08-2014, 12:20 AM)Seven Wrote: So what could you do with this?

(09-08-2014, 12:24 AM)Adorapuff Wrote: Say you get the admin creds to a wordpress site, but they are only slightly stupid and try to secure their admin panel with an addition pass, they might implement a screen like such: http://howtofix.pro/tools/online/htbypass/index.php that needs to be passed in order to get to the WP login screen. Sometimes .htaccess is even used as the only protection on the admin panel.

(09-08-2014, 01:04 AM)Seven Wrote: I see. Do you know if this would work on stuff like cameras and routers. I know my routers webapp has a panel like this.

(09-08-2014, 01:06 AM)Adorapuff Wrote: Depends on if they are vulnerable :p try it out on your router if you like