[38662] in bugtraq
Re: Vulnerability kali's tagboard
daemon@ATHENA.MIT.EDU (Jesus)
Thu Apr 28 19:22:32 2005
Date: Thu, 28 Apr 2005 15:06:53 -0400 (EDT)
From: Jesus <root@resurrected.us>
To: security curmudgeon <jericho@attrition.org>
Cc: piker piker <piker_666@hotmail.com>, bugtraq@securityfocus.com
In-Reply-To: <Pine.LNX.4.61.0504280346300.25578@forced.attrition.org>
Message-ID: <Pine.GSO.4.58.0504281500300.27746@kungfunix.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Thu, 28 Apr 2005, security curmudgeon wrote:
> ******************************************
> * Example .htaccess File
> ******************************************
> AuthUserFile /home/username/public_html/tagboard/admin/.htpasswd
> AuthGroupFile /dev/null
> AuthName "Tagboard Admin Area"
> AuthType Basic
>
> <Limit GET POST>
> require valid-user
> </Limit>
Mod security alleviates most of this
SecFilterSelective THE_REQUEST "\&cmd" "redirect:http://www.gaytardedhax0rs.net"
As do normal apache settings
<Location /admin/>
#
Order deny,allow
Allow from YOUR_ADDRESS_GOES_HERE
Deny from all
ErrorDocument 403 http://www.gaytardedhax0rs.net
</Location>
Problem with an htaccess file is creating the users, then making sure no
kiddiot is using some password dumping script or program. IP based would
work better since I can't think of some silly scriptkiddiot injecting info
on the network level to pwn some site using any one of these injection
based tools.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
"The most tyrannical of governments are those which make
crimes of opinions, for everyone has an inalienable
right to his thoughts." -- Benedict Spinoza
//sil
http://www.kungfunix.net http://www.politrix.org
http://www.infiltrated.net http://bush.shafted.us
