HTTP Authen ?

GovernmentSecurity.org > System Security > Beginners Section

virus

Jul 14 2003, 10:37 AM

Hey there guys,
I want to know if I can bypass HTTP authentication. Is there a way around?

GSecur

Jul 14 2003, 05:29 PM

Depends do you mean htaccess? Then the only way I know of is bruteforcing.

Or do you mean a page with a login in the actual html or php file?

ComSec

Jul 14 2003, 06:10 PM

here is a program from jean fages and trust me its good (jean is member of a forum i also mod over)..his software is excellent

QUOTE

AccessDiver is a software which can detect security failures on your web pages. It has multiple efficient tools which will verify the robustness of your accounts and directories accurately. So, you will know if your customers, your users and yourself can safely use your web site.

screenshots

http://www.accessdiver.com/info_shots.htm

description

http://www.accessdiver.com/description.htm

download

http://www.accessdiver.com/dlad.htm

virus

Jul 15 2003, 08:40 AM

QUOTE (GSecur @ Jul 14 2003, 09:29 PM)

... do you mean htaccess?

Yup .... htaccess is what I meant

virus

Jul 16 2003, 04:04 PM

Alrite .... I've done it. I brute forced a website running phpMyAdmin and I left a message saying that they need to beef up their security. I did it with the help of a program called netBrute (thanks to Gan_GR33N). NOW, What I want to know is that is my IP address logged when I am authenticated through htaccess. And secondly, how can one prevent a server from being brute forced. Can one stop or prevent any such attacks?
P.S: I connect through my ISP's proxy server, so their IP address is logged on any site that I visit. Can they catch me if they want? is it not a long process to go through the logs?

GSecur

Jul 21 2003, 04:05 AM

QUOTE

What I want to know is that is my IP address logged when I am authenticated through htaccess. And secondly, how can one prevent a server from being brute forced. Can one stop or prevent any such attacks?

The answer is yes your IP is logged. The way to stop bruteforcing is to have a good IDS system. An IDS system would pick up your bruteforcing attempts very quickly and then block your IP from the server.

QUOTE

Can they catch me if they want? is it not a long process to go through the logs?

The answer to the first half is yes again, and the second part is yes logs are tedious. But there are probably thousands of entries in there logs from your IP. So.... It won't be hard to figure out. Sorry to say digger but I don't think was the wisest decission

dissolutions

Jul 21 2003, 04:20 AM

There could also be certain filters that point out your IP address... and any long password would take thousands if not tens of thousand or maybe even a hundred thousand attempts... which is a LARGE chunk of log there lol.

As GSecur pointed it out wasn't smart... and one thing that shouldn't need be said... never hack from your house or from your school or job they are too important go to a icafe or war drive a bit and start raiding the free internet access from wireless access points most don't even use encryption a simple spoof of your MAC address could simply do it

w00dy

Jul 21 2003, 05:44 AM

Speaking of war driving, i saw in a ad for best buy or some other overpriced electroncs store, lil standalone 802.11b detectors ($24.99). Perfect for taking with u while running errands around town. Just make a mental note, then go back with a laptop.

I havent been able to find them online, but ill post a link as soon as i do.

dissolutions

Jul 21 2003, 06:59 AM

Yah i've seen them... don;'t quite interest me cause all it is is the frequency detector with a red and green LED and a loud annoying speaker... when get the money i'll just buy an ipaq with a GPS attachment will oinly rack me up a grand but it looks cooler too

But i'm interested int he one you saw wouldn't mind seeing it.

w00dy

Jul 21 2003, 07:21 PM

I was finally able to find the standalone 802.11b wireless hotspot finder. Also, today i got a new miniDV camcorder (Sony TRV-70) Turns out this damn thing can connect to the internet with any usb style ethernet adapter, i.e. usb wireless ethernet.... maybe i can be the first person to ever go wardriving with a camcorder

packet

Jul 22 2003, 03:42 PM

Happy birthday Digger

!

-j

PS: Oh and most good admins have log watchers that will light up like a christmas tree if you try bruteforcing passwords.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.