Apache htpasswd Config - Detect

What is the "Apache htpasswd Config - Detect" module?

The "Apache htpasswd Config - Detect" module is designed to detect misconfigurations in the Apache htpasswd configuration. It targets the Apache htpasswd file, which is used for password authentication in Apache web servers. This module helps identify potential security vulnerabilities related to the exposure of sensitive user credentials.

This module has an informative severity level, meaning it provides valuable information about the configuration but does not directly indicate a vulnerability or exploit.

This module was authored by geeknik.

Impact

If a misconfiguration is detected in the Apache htpasswd configuration, it could potentially expose sensitive user credentials. This could lead to unauthorized access to protected resources and compromise the security of the web server.

How does the module work?

The "Apache htpasswd Config - Detect" module works by sending an HTTP GET request to the "/.htpasswd" path on the target server. It then applies matching conditions to determine if a misconfiguration is present.

The module uses two matching conditions:

- Matcher 1: It checks if the response contains any of the following strings: "{SHA}", ":$apr1$", ":$2y$". These strings are commonly used in hashed password formats. - Matcher 2: It verifies if the response status code is 200, indicating a successful request.

If both matching conditions are met, the module reports a potential misconfiguration in the Apache htpasswd configuration.

For example, the module might send the following HTTP request:

GET /.htpasswd HTTP/1.1
Host: example.com

For more information about Apache htpasswd configuration, you can refer to the official Apache documentation.