#basic authentication

Urlbuster - Web Directory Fuzzer To Bruteforce Existing Or Hidden Files #Andor #BasicAuthentication #Brute-force

[sc name=”ad_1″]

Powerful web directory fuzzer to locate existing and/or hidden files or directories. Similar to dirb or gobuster, but with a lot of mutation options.

Installation

pip install urlbuster

Features

Proxy support

Cookie support

Basic Auth

Digest Auth

Retries (for slow servers)

Persistent and non-persistent HTTP connection

Request methods: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS

Base64 encode on shell

Sometimes you need to encode a string  with a base64 encoding. For example when trying to send a HTTP request with a Basic Authentication header like that:

### own controller: POST http://thedomain.com/webhook/post?XDEBUG_SESSION_START=11931 Content-Type: application/json Authorization: Basic c25zOlVzZVRoZWZvcmNlCg== { "uuid": "08e9a8d3-9279-4af5-88ff-ebe42359f0e0", "eventname":…

Keep Your #Moodle Free From Navigation Frustration With Link Crawler Robot Plugin #moodlenews

Imagine your Moodle course like your own learning mansion. Gold letters at the door name the subject of the course. Inside, long halls lead to room after room, or stairs to the upper floors with more long halls leading to more rooms. You go from “sweet deal” to “who is going to keep my house up?” Wealth can get messy, and it applies for knowledge too. Link Crawler Robot is a crawler that looks…

How to do Basic HTTP Authentication in javascript

What is Basic HTTP Authentication

Basic HTTP Authentication is one of the simplest ways for providing username and password in HTTP request. It uses just fields in HTTP header without handshaking.

  Work to do on a Client side

Make Authorization filed in HTTP header by following below steps.

Make a String concatenating username, a single colon(‘:’) and password

Encode the string in Base64

Set ‘Ba…

javascript로 Basic HTTP Authentication 하는 방법

Basic HTTP Authentication 이란

HTTP user agent가  http request를 할 때, username과  password를 제공하는 방법중 가장 쉬운 방법의 하나로 핸드쉐이킹 과정없이 HTTP header내의 필드들을 사용해서 이루어진다.

  Client side에서 해야할 작업

HTTP header 내에 Authorization 필드를 다음의 절차를 따라 만든다.

username, a single colon(‘:’), password 를 결합한 string을 만든다.

Base64로 encoding한다.

“Basic ” + 인코딩 된 string을 Authorization ‘key’의 ‘value’로 지정한다. (Basic 다음에 space를 반드시 포함해야한다.)

 jav…

Apache http basic authentication

to protect www.site.come/acquisitions/viewLead/viewLead/ put the following in the virtual host portion of the config of the site

<Location /acquisitions/viewLead/viewLead/> Deny from all AuthType Basic AuthUserFile /etc/httpd/viewLead.passwd AuthName Survey require valid-user satisfy any </Location>

htaccess file:

Content of .htaccess file

AuthUserFile /path/to/.htpasswd AuthName "Secure Section" AuthType Basic require valid-user

to create a new password file

htpasswd -c .htpasswd user

htaccess with digest (encryption)

AuthType Digest AuthName "secure" AuthUserFile /etc/apache2/htpasswd/secure AuthDigestDomain /secure/ https://hal.compute.info/secure/ Require valid-user <Files *.html> ForceType application/x-httpd-php </Files>

to create a new password file:

Ruby HTTPS with HTTP Basic Auth

Fetching HTTPS data with Ruby using HTTP Basic Authorization require 'net/http' require 'net/https' def get_feed(server,path,username,password)

http = Net::HTTP.new(server,443) req = Net::HTTP::Get.new(path) http.use_ssl = true req.basic_auth username, password response = http.request(req) return response.body

Creating a REST API using WCF is not that complicated and requires some basic knowledge of WCF and web.config. But figure out how the heck to configure your server/solution to accept basic authentication and check login and password against .Net Membership API is a pain in the ass. Fortunately, we've found an easy way out! Here's what you gotta do:

1. Download WCF REST Starter Kit

http://aspnet.codeplex.com/releases/view/24644

From this solution you simply need Microsoft.ServiceModel.Web.dll to be referenced in your project.

2. Create a class called BasicAuthenticationInterceptor.cs

and copy&paste the following code:

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using Microsoft.ServiceModel.Web;

using System.ServiceModel.Channels;

using System.ServiceModel.Web;

using System.Web.Security;

using System.Security.Principal;

using System.IdentityModel.Policy;

using System.ServiceModel;

using System.ServiceModel.Security;

using System.IdentityModel.Claims;

using System.Security.Cryptography;

using System.Net;

namespace [Your-namespace].RestService.BasicAuthen

{

    public class BasicAuthenticationInterceptor : RequestInterceptor

    {

        MembershipProvider provider;

        string realm;

        public BasicAuthenticationInterceptor(MembershipProvider provider, string realm)

            : base(false)

        {

            this.provider = provider;

            this.realm = realm;

        }

        protected string Realm

        {

            get { return realm; }

        }

        protected MembershipProvider Provider

        {

            get { return provider; }

        }

        public override void ProcessRequest(ref RequestContext requestContext)

        {

            string[] credentials = ExtractCredentials(requestContext.RequestMessage);

            if (credentials.Length > 0 && AuthenticateUser(credentials[0], credentials[1]))

            {

                InitializeSecurityContext(requestContext.RequestMessage, credentials[0]);

            }

            else

            {

                Message reply = Message.CreateMessage(MessageVersion.None, null);

                HttpResponseMessageProperty responseProperty = new HttpResponseMessageProperty() { StatusCode = HttpStatusCode.Unauthorized };

                responseProperty.Headers.Add("WWW-Authenticate",

                    String.Format("Basic realm=\"{0}\"", Realm));

                reply.Properties[HttpResponseMessageProperty.Name] = responseProperty;

                requestContext.Reply(reply);

                requestContext = null;

            }

        }

        private bool AuthenticateUser(string username, string password)

        {

            if (Provider.ValidateUser(username, password))

            {

                return true;

            }

            return false;

        }

        private string[] ExtractCredentials(Message requestMessage)

        {

            HttpRequestMessageProperty request = (HttpRequestMessageProperty)requestMessage.Properties[HttpRequestMessageProperty.Name];

            string authHeader = request.Headers["Authorization"];

            if (authHeader != null && authHeader.StartsWith("Basic"))

            {

                string encodedUserPass = authHeader.Substring(6).Trim();

                Encoding encoding = Encoding.GetEncoding("iso-8859-1");

                string userPass = encoding.GetString(Convert.FromBase64String(encodedUserPass));

                int separator = userPass.IndexOf(':');

                string[] credentials = new string[2];

                credentials[0] = userPass.Substring(0, separator);

                credentials[1] = userPass.Substring(separator + 1);

                return credentials;

            }

            return new string[] { };

        }

        private void InitializeSecurityContext(Message request, string username)

        {

            GenericPrincipal principal = new GenericPrincipal(new GenericIdentity(username), new string[] { });

            List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy>();

            policies.Add(new PrincipalAuthorizationPolicy(principal));

            ServiceSecurityContext securityContext = new ServiceSecurityContext(policies.AsReadOnly());

            if (request.Properties.Security != null)

            {

                request.Properties.Security.ServiceSecurityContext = securityContext;

            }

            else

            {

                request.Properties.Security = new SecurityMessageProperty() { ServiceSecurityContext = securityContext };

            }

        }

        class PrincipalAuthorizationPolicy : IAuthorizationPolicy

        {

            string id = Guid.NewGuid().ToString();

            IPrincipal user;

            public PrincipalAuthorizationPolicy(IPrincipal user)

            {

                this.user = user;

            }

            public ClaimSet Issuer

            {

                get { return ClaimSet.System; }

            }

            public string Id

            {

                get { return this.id; }

            }

            public bool Evaluate(EvaluationContext evaluationContext, ref object state)

            {

                evaluationContext.AddClaimSet(this, new DefaultClaimSet(Claim.CreateNameClaim(user.Identity.Name)));

                evaluationContext.Properties["Identities"] = new List<IIdentity>(new IIdentity[] { user.Identity });

                evaluationContext.Properties["Principal"] = user;

                return true;

            }

        }

    }

}

3. Change Service.svc to the following:

<%@ ServiceHost Language="C#" Debug="true" Service="Service" Factory="AppServiceHostFactory" %>

using System;

using System.ServiceModel;

using System.ServiceModel.Activation;

using Microsoft.ServiceModel.Web;

using [your-solution-name].RestService.BasicAuthen;

class AppServiceHostFactory : ServiceHostFactory

{

    protected override ServiceHost CreateServiceHost(Type serviceType, Uri[] baseAddresses)

    {

        WebServiceHost2 result = new WebServiceHost2(serviceType, true, baseAddresses);

        result.Interceptors.Add(new BasicAuthenticationInterceptor(

            System.Web.Security.Membership.Provider, "[your-solution-name]"));

        return result;

    }

} 

4. In your web.config file make sure to add standard sql membership provider reference as well as to have authentication mode- None

<authentication mode="None"/>

<membership>

<providers>

<clear/>

<add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="SkyferLive" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" passwordStrengthRegularExpression="" applicationName="/"/>

</providers>

</membership>

And at the end of your web.config make sure to add the following lines:

<system.serviceModel>

<serviceHostingEnvironment>

<baseAddressPrefixFilters>

<add prefix="http://[your-pc-name]"/>

</baseAddressPrefixFilters>

</serviceHostingEnvironment>

</system.serviceModel>