Collaborate Disseminate
I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the execution of those files to al… Continue reading How to deny execution of any file on a specific directory?
I am storing hashed passwords in a file called passwords.htaccess. When a user fills out a login form, the passwords are checked. I am getting the contents of passwords.htaccess with file_get_contents(‘passwords.htaccess’);. … Continue reading Can someone view the contents of my .htaccess file
for example, in .htaccess we deny direct access to specific file example.com/myfile.txt, using this command:
RewriteEngine on
RewriteCond %{THE_REQUEST} myfile.txt
RewriteRule ^ – [F,L]
that says, if url contains myfil… Continue reading Is there any way to bypass .htaccess PATH restriction (in URLs)?
The risks surrounding the latest Apache bug, called Optionsbleed, are limited given it can only be attacked under certain conditions. Apache, and many Linux distributions, have patched the flaw. Continue reading Risks Limited With Latest Apache Bug, Optionsbleed
Just a quick post about an interesting file found in a phishing kit. Bad guys use common techniques to prevent crawlers, scanners or security companies from accessing their pages. Usually, they deploy a .htaccess file to achieve this. Today, I found a phishing kit related to a bank (ANZ) with such
[The post Who’s Blocked by Bad Guys? has been first published on /dev/random]
Is it possible to override parent folder .htaccess rules with child php.ini or some other file except .htaccess?
What I have is:
/var/www/site/static/.htaccess
/var/www/site/static/abc/
/var/www/site/static/abc/def/(I have a… Continue reading Override parent .htaccess with php.ini?
If I configure an .htaccess file like this :
RewriteEngine On
RewriteRule ^([^/]*)$ /view.php?key=$1 [L]
Which transforms:
original URL http://www.example.com/view.php?key=123
rewritten URL http://www.example.com/123
I have a dedicated server. There is no code/site live now, only a coming soon page. A few minutes ago I realized that someone has changed the .htaccess file.
How can I protect against that kind of attack?
The new htaccess c… Continue reading Protect against attack that modifies .htaccess?