What is the .htaccess file and what do I use it for?

.htaccess - The Point of DiscussionHT(Hyper Text) access file is actually a directory level configuration file which supports handsome number of servers and those webservers allow administrators for decentralized management of Web Server Configuration. The original purpose of .htaccess ” is reflected inside its name was to allow per-directory access control, for example: requiring a password to access the a directory or file. Nowadays it is used for various other purposes, as .htaccess files can override many other configuration settings including content type and character set, CGI handlers, etc it could very useful for penetration testers as well as webmasters.

Why .htaccess??

The WebServer reads these files every time when the website is loaded. So the changes to the .htaccess file can immediately effect the Server with respect to main Configuration file of server. .htaccess can also be used to authorization/authentication i.e. permitting or denying a user to access a certain content.

1.Authorization & Authentication

A .htaccess file is often used  for both authentication and authorization i.e. to specify security restrictions for a certain resource. The .htaccess file is often accompanied by a .htpassword file which stores valid usernames and their passwords for authentication purposes. We will see examples of both of them (Authorization and Authentication) in later part of this article.

2.Rewriting Urls

Rewriting is sometimes used as conditional operator to add filter to block a specific word or string in a statement.

3.SSI

SSI can be actually helpful to maintain a website dynamically using input parameters specified by the administrators. SSI directories can be defined within the .htaccess itself.

4.Customizing the Error Responses

A .htaccess file can also be used to customize error messages. For example -  What to do if a 404 error occur?, Shall it be redirected to the homepage?, we can also control other things such as Mime types, cache control etc.

Where .htaccess Should Be Placed?

So, we have already discussed about various uses of  .htaccess, now its time to know where .htaccess file should be placed for optimal performance. .htaccess should be placed inside root web directory of the webserver,  so that it could have same effect on all the content within the website but sometimes, it could be placed in a specific directory to perform a task.

For example - A hosting company has described the maximum upload limit of 100mb per image, however in case if one of the customers wanted to upload a picture that is of 110mb what should he do?, He would contact the hosting company ofcourse, now instead of allowing the upload of 110mb from the server for all users, the company would ask the user to place a .htaccess file inside the directory and set the upload limit to 110mb.

Note:This files needs to handled with utmost care because of its sensitiveness. Even a single mistake can lead you to some serious security concerns, So if you don't know what you are doing, we would recommend not to play with it.

Advantages

One of the main advantages of a .htaccess file is that the changes made to this file would take immediate effect on the webserver as opposed to making changes in the main configuration file which often requires the server to be restarted and hence a downtime might occur.  Also, as we explained from the above example that .htaccess allows unprivileged user to perform a privileged action without need to change the main configuration file.

Disadvantages

There are two main disadvantages of .htaccess, one it creates performance loss, second it raises security concerns as you are allowing an unprivileged users to modify the configuration changes. For example - System administrator has disabled the use of the "Symbolic links", however the overrides are allowed, in case if an attacker compromises a single website on the server, he could create a custom .htaccess which would allow symlinks if they are not enabled by default and hence it would allow an attacker to read files outside the user's home directory. The folllowing .htaccess file would allow an attacker to enable and follow symlinks:

OPTIONS  Indexes Includes ExecCGI FollowSymLinksAddHandler txt .phpAddHandler cgi-script .cgiAddHandler cgi-script .plOPTIONS  Indexes Includes ExecCGI FollowSymLinksOptions Indexes FollowSymLinksAddType txt .phpAddType text/html .shtmlOptions AllOptions All

As regards with the performance impact, guys at drupal groups have provided a great explanation. "Here are some excerpts from Wrox's 'Professional Apache' in the chapter on improving Apache's performance:"

"If AllowOverride is set to anything other than 'None', Apache will check for directives in .htaccess files for each directory from the root all the way down to the directory in which the requested resource resides, after aliasing has been taken into account. This can be extremely time consuming since Apache does this check every time a URL is requested, so unless absolutely needed, always (set AllowOverride to 'None')"

Source - https://groups.drupal.org/node/22864

How .htaccess can help in improving security? 

Preventing Common Attacks (But not fully). .htacess can be used to define a blacklist of keywords that you would like to block when it arrives the server. Take a look at the following example

"RewriteEngine on" is responsible for starting the filtering process followed by the specific keyword word you would like to block, which in this case is "order". In this way .htaccess can be used to create a blacklist to filter out malicious inputs for attacks such as SQLi, XSS, LFI, RFI etc. However, this approach is not recommended as blacklist has never been the solution for any security related problem, instead the best option is to fix the vulnerabilities from within the code, the vulnerabilities can be detected via static or dynamic code analysis.


The following screenshots give examples on creating a blacklist with the help of .htaccess:

Authorization

As discussed before .htaccess could be very helpful for "Authorization" i.e. we can define who is authorized to access the content, in simpler words we can permit or deny a specific Person(s) based upon his IP address .

All we have to do is to simply use allow and deny keywords with in the .htaccess. This feature could be used as a security for admins to only allow their IP to access the administrator page .

Authentication

.htaccess can also be used to password protect a directory, for that we would also need an .htpasswd file. A .htpasswd contains the username and password for basic authentication of users. The following is a great website that could be used to generate .htpasswd files:

• http://www.htaccesstools.com/htpasswd-generator/

The Protected content could be accessed as follows: http://username:password@www.website.com/directory/

The following screenshot demonstrates the usage of .htaccess by etsy.com to protect wp-admin page for wordpress.

Hiding Errors

This approach is also not recommended and it's called as security through obsecurity, which means that if an attacker cannot find something he is less likely to exploit it.  The idea behind this technique is to turn of php errors, which would not return errors for common vulnerabilities such as SQLi, FPD, LFI etc. However, this approach would only prevent script kiddies not real penetration testers.

Switches Used while working with Php Flag are : php_flag display_errors no/yes [on/off]

Last but not least, we would recommend following video, in case you are really interested in learning more about this topic.

Conclusion

 In this article, we precisely tried to cover various aspects of the .htaccess file, however this topic is far from over, based upon your comments and feedback we might come up with it's part 2.

About Author

This article was original written by Muhammad Adeel (independent Security researcher), however it was later modified by "Rafay Baloch" to make it more clear and understandable.

Read more

by Malik korrich ~ mardi 15 avril 2014 0 commentaires

ZERO-DAY A Future Threat, And How To Protect Your Data

ABSTRACT

It is known that practically all software has security flaws (programming problems that give individuals opportunities to explore previously nonexistent), many of these vulnerabilities not yet discovered, and hundreds are corrected every month through the packages available organizations affected, sometimes new versions and updates.


The term "zero day" (zero hour or 0day ) refers to the unknown nature of security breaches for companies , this attack tries to exploit computer application vulnerabilities that are unknown yet even by software manufacturers . Explaining in a simple and generally, there are two types of "exploit", or flaws / vulnerabilities that can be used in attacks. Those found by security companies and found by hackers whose purpose is exploration.

The issue is that some hackers choose to disclose newly discovered failures to apply the necessary corrections are sometimes rewarded for it with prizes. The "black hats" prefer to save for their own benefit ne a future attack or to share with attackers before the developer of software knows about the vulnerability.

HISTORY ALGORITHM AES

Regarding PRIVACY is important to know how to control the availability and exposure of your data , the AES algorithm was proposed to replace DES, NIST ("National Institute of Standards and Technology U.S.") held a competition (The selection process began in 1997 and ended in 2000 with the victory of the Rijndael algorithm written by Joan Daemen and Vincent Rijmen) for it to be made an algorithm that would be called "Advanced Encryption Standard " that meets the following specifications: algorithm publicly defined;

Being a symmetric cipher block; Designed for the key size can be increased; Deployable in both hardware and software; Powered freely, this algorithm Encrypt and Decrypt using an encrypted key and blocks, both sizes of 128,192 or 256 bits.

I will cite and explain how an open source tool very important: TrueCrypt (encryption on-the-fly OTFE) to confidential files , folders and entire drives on your PC , encryption, it can create a virtual encrypted disk or encrypt a partition , individual algorithms supported by TrueCrypt are AES, Serpent and Twofish, additionally , five different combinations of cascaded algorithms are available : AES-Twofish, AES-Twofish-Serpent, Serpent-AES, Serpent-Twofish-AES and Twofish-Serpent. Uses RIPEMD-160, SHA-512 and Whirlpool as hashing functions.

SOLUTION

Due to the increasing amount of 0day discovered, I will present one of the safest techniques to protect the security of your data, first we store our data in a nonvolatile memory device (eg USB stick or external HD, is the storage, where once recorded, the data are not lost when you remove the power source), we will also create a volume HIDDEN, at worst it can happen that you are forced by somebody to reveal the password to an encrypted volume . There are situations where you cannot refuse to reveal the password, for example, due to extortion. The method is to use a volume "HIDDEN" that allows you to solve such situations without revealing the password to your volume true, we actually create two passwords, a password can be used for volume "False" and one for the volume "True".

In case of any extortion can provide the password "Fake" where the attacker will have access, and the information contained in this folder will be irrelevant.

STEP BY STEP

Choose the "Create Volume".

Step1.


Select "Create an encrypted file container" then click "Next".

Step2.

Select "Hidden TrueCrypt volume" and click "Next".

Step3.

Then we select this option, the wizard will first help you create a normal volume and then a TrueCrypt hidden volume within it.

Select “Normal mode” and click “Next”.

Step4.


Choose a name for the file and click "Save".

Step5.

Select the location of the outer volume to be created (within this volume will be a hidden, that will be created later).Go straight on "Next”.

Step6.

Again click "Next".

Step7.

Select the type of encryption algorithm you want to use:

Step8.


Enter the volume size and click "Next".

Step9.


Choose a password, the more characters better, example: p@ssword.

Step10.

Select the "Format" and click.

Step11.


Now wait for the formatting, you can move the mouse quickly to generate a better randomness.

Step12.


Let's create the next volume, click "Next".

Step13.


We will continue to do our hidden volume, again click "Next".

Step14.


Select the encryption mode you want to apply to your new volume.

Step15.


Enter the size of another volume.

Step16.


Choose a secure password and different from the first, with many characters and click "Next".

Step17.


Ready! Now the volumes are made, and beyond the expected, you have a hidden volume and secret to save your important data.

Step18.


Just click on "Exit".

Step19.


So let's understand how the volume created within the other, known as External.
Let's open Truecrypt and then first open the main volume, choose FILE SELECT, and we select the volume created.

Step20.


Click to open.

Step21.


Click on "Mount".

Step22.


This screen will ask for the password, remember that you have two, the volume for false and one for true.

Step23


Choose which put password.

Step24.


Pay attention to the volume that opened was the "normal".

Step25.


You can use social engineering if you need some day.

Step26.


Click on “Dismount”.

Step27.


We will select the same item again, now to test with another password.

Step 28.

Enter the password for the hidden volume.

Step29.


Note that our hidden volume appears, note the size and type.

This article shows a technique for case one day you will be forced to disclose information, learn how to get out of this trap.

It's also a great way to protect your company's data and a security strategy that should apply to stay quiet with your important data.

About the Author
This is a guest post written by , RAFAEL FONTES SOUZA.He is the maintainer of the “Project Backtrack Team Brazilian”, He is also a member of the "French Backtrack Team" and made partnerships with groups from Indonesia and Algeria, was prepared a collection of video lessons and made available on the website.

He am Founder of the "Wikileaks and Intelligence, Cypherpunks". Good communication in groups and the general public, attended college projects with a focus on business organization, he currently seeks work experience outside of brazil”.

Read more

by Malik korrich ~ mercredi 30 octobre 2013 0 commentaires

Hijacking Facebook Users With Clickjacking Attack

Clickjacking is one of most used attack on Facebook. Scammers use this attack to increase like of a Facebook page and spread some malicious links on Facebook user’s profile. Most of the strange looking auto spreading scams on Facebook are Clickjacking attacks.

Clickjacking name is taken from click Hijacking. In this attack, hacker hijacks users’ click to perform some actions on the webpage. This attack is also known as User Interface redress attack, UI redress attack or UI redressing. In this attack, hacker tricks innocent users to click on something which is not the same thing user is clicking. It means user tries to click on some link button for some specific task while the button or link performs something else.

How this attack works?

As the name suggest, hacker hijacks the click of the user. But this sounds complicated. In this attack, hacker use modified frames in the way that only a specific part of the webpage is visible on the page.

For example, imagine a hacker created a web site that has a button on it which says "click here for get free gifts". But, on the top of web page, hacker has embedded an iframe with a button for subscription directly on top of the "free Gifts" button. Victim visitor will try to click on free gifts button but instead actually clicked on the invisible Subscription button.

This attack is performed with the help of 2 iFrame. First of all we will add the target button to the top left of the webpage in an iframe. First IFrame is used to hide all other elements of the webpage which originally contains the button. Hacker hide border and scroll. This will make hard to identify the frame on the web page.

#inner { position: absolute; left: -600px; top: -600px ;}

Change the position and iframe size according to the button you are adding.

Now add this web page on target web page inside an IFrame at the position where we want to add the button. Second IFrame is used to add this button on the target web page where we want it to be clickjacked. Do not use border and scroll in this frame too. Now add some texts and images around this framed button so that it appears the part of the page. Also put some false message to get users click on the button.

LikeJacking:  Likejacking is not the different attack. It is the Clickjacking attack which is used to increase the like of a Facebook page or a Facebook post. Facebook got the solution to prevent this attack in the Facebook’s hacking event Hackathon. Although, Facebook has implemented many security levels to prevent this attack, but hackers always gets some way to perform this on facebook.

Protection against this attack: This is a harmful attack and can be prevented by server side and client side both.

Server Side Protection: Most successful server side protection against this attack is "Defending with Frame Breaking Scripts." In this web developer add a script on the web page which prevents the web page to be framed. This is the code which is used to prevent the page to be framed.

But there are few methods which can break the protection.

Client Side Protections: There are some add-ons and tools available which are used to protect browsers against this attack.

NoScript: No doubt, NoScript is the most useful Firefox add-on which protects users from many types of web attacks. This add-on also prevents users from clicking on invisible or “redressed” page elements of embedded documents or applets. This is the best security tool against this attack.

Ghostery: This is also a nice browser extension which is also used to protect users against this attack. This privacy browser enables users to detect and control tags, web bugs, pixels, and beacons on the webpage which can collect data from their web browsers.

As we know that there is no permanent solution exists to prevent this attack from the server side, we should try to add protections to our web browsing. So I will suggest all users to use client side solutions. If you use Mozilla Firefox, then you must have NoScript Add-on in your web browser. This will protect you against many types of web attacks.

Author Bio:

Deepanker verma is a security researcher and a computer programmer. You can follow his articles on http://hackingtricks.in and http://www.tricksndtricks.in

Read more

by Malik korrich ~ samedi 31 mars 2012 0 commentaires

Facebook Hacker V1.0 - A Keylogging Software

We have wrote several articles on Facebook Hacking, The most recent one we wrote was on "Top 10 Ways How Hackers Can Hack Facebook Accounts In 2012". Which received tremendous amount of responses. However in today's article we would like you to introduce you a software named "Facebook Hacker. Hacking facebook accounts using phishing methods are out of the fashion these days. A new tool known as facebook hacker is introduced. A dangerous tool for the people in need of other’s username and passwords.

This tool is extremely easy to connect and use. All you have to do is give an email address and a password where the stolen information is to deliver. Can’t be easier than that.

Just type in the email address and password and then click on the build button. A new “SERVER.EXE” file will be created and most of the work is already done. Now the big part comes. Just send this file to the victim. Rename it, change the icon and make it more presentable so that the victim opens it for sure.

As soon as the victim opens the file, Server.exe will get all the passwords saved and facebook account credentials and will give them to you. To avoid detection, the facebook Hacker will also look for all the processes related to a security suite and kill them upon detection. The most important thing this software does is it kills all the security suite detecting it.

You should know how to protect yourself from such threats. BitDefender detects this as a Trojan. In order to stay safe ensure that you update your antivirus regularly. Also, remember not to run files you may receive as attachments or via IM, or at least, to scan them beforehand.

Download Facebook Hacker V1.0 here

About The Author


This article has been written by Amin Motiwala, He is the newest member of our team. If you would like to become a member of our team, Kindly shoot an email to rafayhackingarticles@gmail.com

Read more

by Malik korrich ~ lundi 19 mars 2012 0 commentaires

Top 50 Passwords That Can Get You Hacked Instantly

Passing guessing is one of the fastest technique to hack any account. According to a survey by Sophos 33% of the people use the same passwords. What this means that if a hacker can get inside a person's facebook account, he can also get inside his/her other account using the same password. The chart below is the set of most commonly used Gawker Passwords that were leaked online due to a security breach. 

The following incident shows us how careless people can be while choosing their passwords and ultimately getting themselves hacked. Alternatively if you are worried that you password might be guessed or simply want to check if you are using a poor passwords. Kindly refer the our post below:

• How To Create Strong Passwords

Read more

by Malik korrich ~ dimanche 26 février 2012 0 commentaires

How To Deal With Insider Threats?

The biggest threats to IT security don’t originate from outside a company. Employees, contractors, and business partners on the inside pose a far greater security risk. As long as your current or former staff and associates have access to your internal network, you are vulnerable to a security breach.

Here’s how to deal with the real and significant threat of attack from insiders, and avoid the widespread damage they can unleash on your company’s finances and reputation.

First: Assess the Risk

For most firms, implementing full protection against every possible threat is not feasible. It makes more sense to assess the risk, determining which data is critical and which is relatively unimportant. Protect critical resources first.

Next, decide who needs access to the network. Make sure that individuals such as partners, suppliers and contractors have access only to the information they need to serve your company or customers.

The third step in assessing risk is determining who are the potential threats, why they would want access to the network, and how they could gain entry. At this stage, many organizations only consider external threats: competitors, random hackers or former employees. Don’t neglect analyzing your insider threats, as well – including the staffers tasked with protecting the system.

Once you’ve uncovered vulnerabilities, you can take steps to prevent an insider attack.

Implement Preventative Measures

Among the best practices for preventing insider threats are:

• Institute clear policies and controls; be sure all employees are aware of acceptable network use and what constitutes a breach.
• Enforce policies consistently; maintain proper paper trails.
• Implement security awareness training; reinforce its importance.
• Segregate duties to reduce risk.
• Encourage employees to come forward and identify suspicious behavior, malicious insiders, threats against the company or attempts at exploitation.
• Implement proper system administration safeguards on critical servers.
• Monitor trusted users.
• Audit access to customer information.

In addition, you’ll want all the usual technical protection against spyware, malware and viruses, firewalls, and regular security patches. Consider securing the physical space as well, with entry and exit controls and badges to monitor employees, delivery people and visitors. You want to hire security personnel to discourage criminal activity.

Finally, Know Whom You’re Hiring

Failing to thoroughly check out a potential hire leaves a company vulnerable to insider threats. It goes without saying that thorough background checks are necessary for any prospective new employee who will have access to sensitive information, from customer credit card numbers to crucial application source codes. But for better protection, extend that practice to all employees and contractors.

Background checks should include a criminal history report, a credentials check and a credit check. Hiring managers should verify past employment and speak to former employers regarding the applicant’s history of dealing with workplace issues. Any information gathered should be part of the decision-making process.

Monitor Employee Behavior

Once an employee is hired, be sure supervisors are tasked with reporting any strange or inappropriate behavior. Compare such incidents to systems logs to determine if anything unusual is happening. And remember to enforce all security policies. If employees learn they can get away with small violations, they may be emboldened to move on to bigger and more lucrative security breaches.

Be Aware and Vigilant When Dealing With Insider Threats

Whether they modify data, steal critical codes, sell company secrets or commit payroll fraud, insiders are the biggest security threats a company will face. While there is always an element of risk, you can decrease information system vulnerability with these common sense steps. Most importantly, by being aware and vigilant, you’ll be better prepared to avoid the losses that far too many organizations suffer at the hands of trusted insiders.

As more companies move more of their businesses online we should expect to see more threats. Formal IT security training can help defend against these threats. Consider Villanova University’s online programs such as their CISSP certification prep courses

Read more

by Malik korrich ~ lundi 23 janvier 2012 0 commentaires

Facebook Phishing Scams At It's Best

Phishing as discussed before is one of the most widely used method to hack a facebook account, Phishing holds the top position in an article I wrote on 10 Ways How Hackers Can Hack Your Facebook Account In 2011. There are variety of methods to carry out phishing attack, In a simple phishing attacks a hacker creates a fake login page which exactly looks like the real facebook page and then asks the victim to login into that page, Once the victim logins through the fake page the victims "Email Address" and "Password" is stored in to a text file, The hacker then downloads the text file and get's his hands on the victims credentials.


In a recent research by security-web center, A collection of 35 phishing sites have been made public, below mentioned are the 35 different phishing websites found by security-webcenter.

Note: Please Don’t Try to login on listed websites.


http://www.sanagustinturismo.co/Facebook/


http://www.facebook.pcriot.com/login.php


http://deadlyplayerx.binhoster.com/Facebook/securelogin.php
http://facelook.shop.co/login.php


http://sigininto.horizon-host.com/facbook/facebook.php


http://custom-facebook.info/facebook.htm


http://www.profile.co.gp/facebook/photo.phpfbid=12447510&set=a.478812.I41224&type=1&theater.html


http://s6.mywibes.com/facebook.htm
http://www.fjtech.us/


http://myoneid.site90.com/
http://facedook.co.gp/wwwfacebookcomprofilephpid100001548737188.htm


http://faceebook-com.bugs3.com/login/Secured_Re-login/index1.html


http://facebooook.axfree.com/


http://combatarms.free.fr/


http://sweed.web44.net/


http://thekshitij.in/facebook/index1.html


http://addgames.awardspace.biz/


http://www.profile.co.gp/facebook/


http://www.sjscheat.com/Hosting%20blogger/facebook


http://h1.ripway.com/denal/


http://1337r00t.13.ohost.de/r00tw00tkn00wn/


http://faacebok.zapto.org/


http://h4ck3rgadungan.adfoo.info/index1.html


http://www.2498.b.hostable.me/
___________________________________
+ Updated (28.11.2011):
http://www.facebook.reekcreations.com/


http://wvw.facebook.com-photos.php.id.1574348425.jgold.in/


http://fan-pages.vgig.ir/facebook.com.home.php.sk-2361831622.applicationspage/


http://timkoch71.net46.net/1638765386283/facebook/


http://privacy-facebook-it.f11.us/check_privacy.htm


http://www.configsetting.com/facebook/login.htm


http://facebook-beta.kilu.de/facebooklogin.html


http://www.frfacebook.fr/


http://fun4iran.tk/facebook.unfiltered/Index.htm


http://login.eu.nu/facebook/photo.phpfbid=1248427590010&set=a.1292457490730.34590.1809072438&type=1&theater.html

How Do People Fall For These Link?

LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable your account within 24 hours if you do not do the reconfirmation.


Please confirm your account below:


[Link Removed]


Thanks.


The Facebook Team


Copyright facebook © 2011 Inc. All rights reserved.
At this point of time you might be wondering, how do users fall for these kind of scams, How are they redirected to these phishing pages. Now there are lots of ways how attackers do it, However Here is an example of a recent facebook account delete scam.


The victim is sent the above message from a random email address which appears to be something like facebookprivacy@gmail.com, account_delete_facebook@gmail.com, while looking at these email address the victims feels that the email is from a legitimate source.

Read more

by Malik korrich ~ lundi 28 novembre 2011 0 commentaires

'Play Mario Kart On Facebook' Scam

A new scam has hit Facebook and it now involves a very lovable gaming character, Mario. Yes, the same Mario that lingers in the background of our precious childhood memories.

Play Mario Kart on Facebook!
[LINK]
Play Mario Kart on Facebook with your Friends! Join the multiplayer mayhem NOW! Click here to play

The scam is spreading fast via status updates and private messages as well.


If you get enticed and click on the link, it redirects you to a page that encourages you to try playing Mario Kart.


As soon as you hit 'Play Now', it takes you to an online survey. Some users have even reported that it encourages you to download and install a browser extension on your PC (highly unrecommended).



A similar scam has appeared on Facebook. Here, it gives you a chance to win an iPhone 5. And of course, this trick has worked on many users, Apple Fanatics or not. Which is understandable, seeing that no one wants to give up the chance of winning free stuff. Even if it comes at the price of security and privacy breeches.


Facebook's own security measures have been unable to identify the problem thus, the scam has plenty of space to work with and affect as many users as possible, giving the scammers 'Big Bucks' that they work so hard for.


To avoid the risk of being scammed, please do not click on the links being sent to you that promise you things that you can not have (not yet, at least). Delete private messages and your own status updates to avoid referring your friends from being scammed too (unless, you want them to be scammed ;)).

Remember, its better to be safe than sorry.

Read more

by Malik korrich ~ jeudi 27 octobre 2011 0 commentaires