Forum Discussion

ArthurDent's avatar
ArthurDent
Bronze III
1 month ago
Solved

Apache Header Tampering

Can someone point me to the right track? On this one, I found the hidden directory, used an X-Forwarded-For: to see into that directory where scanning for files showed a lot of 404s, with just a few ...
immersive labs
offensive cyber
  • ArthurDent's avatar
    ArthurDent
    29 days ago

    Finally solved it. The main fuzzing filelists in /usr/share/seclists/Discovery/Web-Content do not have a specific filename that is used to prevent web crawlers from entering directories. Once you identify that, everything else should be easy. 

SamDickison's avatar
SamDickison
Icon for Community Manager rankCommunity Manager
1 month ago

Hopefully someone here knows. All I have is "try focussing on specific HTTP methods other than restricted ones like POST and GET"

  • ArthurDent's avatar
    ArthurDent
    Bronze III
    29 days ago

    Finally solved it. The main fuzzing filelists in /usr/share/seclists/Discovery/Web-Content do not have a specific filename that is used to prevent web crawlers from entering directories. Once you identify that, everything else should be easy.