1

I am trying to solve this web challenge which requires to bypass an htaccess based form authentication. after some research i tried to change the request to

GETS /admin/ HTTP/1.1

Host: htaccess.hacking.w3challs.com

User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

from the original header

GET /admin/ HTTP/1.1

Host: htaccess.hacking.w3challs.com

User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

using burp suite but i am still not able to bypass the authentication form. any tips what's wrong with my approach ?

  • Why did you change the method to the invalid GETS? – Arminius Nov 13 '16 at 17:04
  • i read read an article describing that if we use any other method instead of get or post then the request will not be validated due to not using <LimitExcept GET POST> properly. – Manvendra Singh Nov 13 '16 at 17:33
2

This simply means that the server is not vulnerable in the way you are expecting it to be (using GETS instead of GET to bypass black-listing of HTTP verbs).

I tried passing a path like: http://htaccess.hacking.w3challs.com/?page=/.htaccess and directory traversal seems to be possible. Try looking for a .htpasswd file somewhere in the directory tree.

0

The use of verb juggling or a mangled HTTP verb like GETS to bypass authentication requires 2 configuration options on the server (Apache example provided).

  1. Authentication must be implemented with a <Limit VERB VERB VERB> directive. As this only enforces authentication for the listed verbs. If the restrictions only cover GET and POST for example you can bypass this with ver juggling (use PUT instead of POST)

  2. If you cannot juggle a verb you may be able to juggle anyway by using a mangled verb such as GETS instead of GET. However this is only possible if the application handler allows unknown verbs or does a bad job validating known verbs (such as the php script handler).

If the authentication is implemented without this variation of the <Limit> directive there are no known bypasses that I'm aware of.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.