This is my first question and I'm completely new to learning about information security. If I've violated any rules while asking this question please let me know, so I can improve it!
I am trying to complete a CTF challenge where you have given the following information:
- the ip adress of a Ubuntu/ Apache 2.4.18 server
- connecting to the ip adress shows a 403 error/ access is denied
The objective of the challenge is to get access to the server.
Next I searched for possible vulnerabilities with Apache 2.4.18 and found this vulnerability:
It says that by using "httpd's ap_get_basic_auth_pw() API function outside of the authentication phase" you can bypass authentication, which should lead to gaining access to the server.
Now my question lies in how do I actually use this vulnerability to gain access? I have researched the basics of the http request-response cycle and so far have learned how to make a simple http request. I understand that you can craft a specialized request with which you can exploit the vulnerability. However I do not know how to go about actually using the ap_get_basic_auth_pw() function within a request or how to use it before the authentication phase.
If you could tell me how I can proceed or in which direction I should look to learn how to solve this challenge, I would appreciate your help!