22

Maybe a noob question. I've tried searching but maybe my search terms were too specific.

I've just conducted a pen test on a client's site. The site allowed me to download .htaccess just by simply browsing to directory where it was stored; www.example.com/dir/.htaccess

What causes this and how can it be remediated?

Improve this question
1
  • 6
    People might be more worried about accessing .htpasswd though – PlasmaHH Sep 16 '15 at 14:07
30

It depends on the type of the webserver in question. If it's apache, it should contain something like this in the config file (usually in the "main" apache.conf):

<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
    Satisfy all
</Files>

If it's missing, that can cause the problem you described.

The other typical cause of this is that the client have used apache in the past, but switched to something else (e.g. nginx) which does not use .htaccess and hence doesn't treat it in a special way. The solution in this case is webserver-specific, but it usually boils down to restricting access to files beginning with ".ht", or - if they are really not used - you can simply delete them.

Improve this answer
4
  • 2
    The server was nginx! Didnt realize nginx dosnt support .htaccess. Thanks! – Rob Sep 16 '15 at 10:52
  • 9
    I'd block all files starting with .. This includes .svn, .git, etc. While these shouldn't be in a directory accessible via http, I've seen several servers where they are. – CodesInChaos Sep 16 '15 at 15:31
  • @CodesInChaos: You mean you don't deploy a web directory with svn checkout? – Joshua Sep 17 '15 at 5:00
  • @Joshua your web directory should be a subfolder in version control, really. keep anything sensitive out of the webroot. Oh, and use git :p – Amelia Sep 17 '15 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.