0

In testing a website on a bug bounty platform. What can reasonably be deduced from the following situation?

GET /.ht -> returns a 403 Forbidden
GET /.hx -> returns a 404 Not Found

The only deduction I can make is that a regex is used to determine the response of the request.
That regex would look like \.ht\w+

This won't result in a vulnerability in any way but it would help me to understand the mechanics of the site.

2 Answers 2

1

The default configuration in Apache blocks access to all files that begin with .ht:

AccessFileName .htaccess

#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
        Require all denied
</FilesMatch>

As the comment says this prevents your .htaccess and .htpasswd files from being accessible via the web. Since most files aren't named .htsomeotherfile the risk of a false positive isn't very great.

This behavior can be useful when assessing servers as a request to .htsomething will only deny access if it's accessing a real directory. So if you suspect that a URL might be configured with an Alias, Redirect or SetHandler f.ex you can append .htaccess. If you get a 403 its probably a real directory and if you get a 200/301/404/etc response it is something else.

F.ex, you might compare the HTTP responses between the following URLs and see for yourself:

Every time you observe a distinct response from a web server it's worth learning why. I've taken advantage of Apache quirks like this in the past with my HTTP fingerprinting tools and htaccess based shells:

1

Basically, what you have already deduced.

It's very likely that the server is Apache and is using some sort of regular experession, just like you stated.

Furthermore, the server likely checks whether or not you are allowed to access a file, before it checks if that file really exists. I wouldn't be surprized if access to .htdoesnotexist or .htsidajfkljsdhgkjh was returning a 403 forbidden as well.

As for your call to .hx returning a 404, that likely means that files beginning with . are not categorically forbidden. While the chances are slim, you may be able to find a .svn or .git folder, which in turn may give you access to source code, hard-coded credentials, etc.

Aside from this, there's really not much information to be gained from what you have discovered so far. It's certainly not a vulnerability in any way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .