full-disclosure - HTTP Verb Tampering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20090706171325.21B4EB8043@smtp.hushmail.com>
Date: Mon, 06 Jul 2009 19:13:25 +0200
From: s0ul@...hmail.me
To: "Full Disclosure" <full-disclosure@...ts.grok.org.uk>
Subject: HTTP Verb Tampering

hey guys,

i need some help with a HTTP Verb Tampering attack!
by using this attack i already gained access to a folder secured by 
.htaccess - my problem at the moment is:

HOW TO DOWNLOAD FILES BY USING HTTP Verb Tampering?

GET, POST and HEAD methods are excluded via .htaccess is there any 
other method or http verb which allows me to download files without 
having to gain "real" admin status?

thanx for your help,
sincerely, 
s0ul 

--
Find the right voice for your project by clicking here!
 http://tagline.hushmail.com/fc/BLSrjkqeFODyUoGdFsWDkBpxQDOZ5jUIytygbZUMolB9pKy3FjUMy78EFAs/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/