Webapp security¶

Summary of many topics from webapp security

Bypass .htaccess¶

curl -X PUT http://example/flag

curl -X GETS http://example/flag

PUT: Sometimes only GET and POST are restricted, where different methods are allowed
GETS: Sometimes unknown methods are pass by Apache to PHP engine, which should interpreted it by himself. But if it is not implemented, by default it is threated as GET. It is feature, not bug, for implementing new protocols like DAV PROPFIND.

Correct htaccess: .. code-block:

<Limit GET POST>
  require valid-user
</Limit>

<LimitExcept GET POST>
  Order Allow,Deny
  Deny from all
</LimitExcept>