Account Options

  1. Sign in
The old Google Groups will be going away soon.
Switch to the new Google Groups.
Google Groups Home
« Groups Home
Discussions > Random chit-chat > htaccess and user agent question
There are currently too many topics in this group that display first. To make this topic appear first, remove this option from another topic.
There was an error processing your request. Please try again.
flag
  19 messages - Collapse all  -  Translate all to Translated (View all originals)
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 
From:
To:
Cc:
Followup To:
Add Cc | Add Followup-to | Edit Subject
Subject:
Validation:
For verification purposes please type the characters you see in the picture below or the numbers you hear by clicking the accessibility icon. Listen and type the numbers you hear
 
djc  
View profile  
 More options Jul 22 2007, 1:20 pm
From: djc
Date: Sun, 22 Jul 2007 10:20:12 -0700
Local: Sun, Jul 22 2007 1:20 pm
Subject: htaccess and user agent question
user agent:  Any of you know what the section of the user agent that
shows the bots URL is called...like ++http://www.google.com/bot.html

htaccess: I'm not an Apache/UNIX person.  I am correct in assuming
that htaccess issues server directives (not the term I'm looking for
but close) and wouldn't include things like stored procedures or
anything a bot could activate with "post" rather than "get"?

1 of my 3 fake files with write permissions was hit via "post" but not
altered.  Since it's on a windows server, not sure if that's why
nothing happened or if the "post" is meant to trigger an already
altered file.

I turned my robots.txt check from whs to asp and put it online.  When
I get time to work on it some more it will be .Net and check for a few
other things.  If you've been using your own but haven't had time to
block out any HTML it finds, feel free to use mine. (for those of you
who haven't heard, someone got their htaccess hacked and it served
HTML to GoogleBot when it tried to fetch the robots.txt)

http://coplien.com/tools/botcheck/


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 22 2007, 6:45 pm
From: webado
Date: Sun, 22 Jul 2007 15:45:10 -0700
Local: Sun, Jul 22 2007 6:45 pm
Subject: Re: htaccess and user agent question
I use Apaceh servers, but I'm no expert either, as I don't have access
to anything higher than my own account.

On a properly configured Apache server the .htaccess file is
inaccessible to  http access. It wil lbe accessible to ftp access, but
it's one of the hidden files, so the ftp software needs to activate
viewing hidden files to see it at all (easy step though). However it
can be uploaed in any case and will simply overwrite any .htaccess
file that is there already.

It's not an executable, it's just somewhat like an ini file, more
defining the enviroment and some rules, in addition to or overriding
those in the file loacated higher up  and generally inacessible,
httpd.conf.

Depending on server configuration the .htaccess file may be used to
define php variables, which otherwise may get defined in a php.ini
file. On my server neither is possible. The php enviroment is fixed
and cannot be modified by anybody at my level. The php environment
used to be available fro consultation  through the output from the php
function phpinfo but this too has now been disabled as a potential
security risk (damn inconvenient actually).

I have never seen directives that would indicate what you are saying,
whether this or that procedure is available by post or get.
But... I don't know everything ... the more I learn the less I realize
I  know LOL

On Jul 22, 1:20 pm, djc wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 22 2007, 6:48 pm
From: webado
Date: Sun, 22 Jul 2007 15:48:54 -0700
Local: Sun, Jul 22 2007 6:48 pm
Subject: Re: htaccess and user agent question
Is http://coplien.com/tools/botcheck/ supposed to generate a download
of the file index.asp?

On Jul 22, 6:45 pm, webado wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
cass-hacks  
View profile  
 More options Jul 22 2007, 8:22 pm
From: cass-hacks
Date: Sun, 22 Jul 2007 17:22:24 -0700
Local: Sun, Jul 22 2007 8:22 pm
Subject: Re: htaccess and user agent question
Off topic but maybe useful anyway, do you two have shell access so
that you can log in using SSH?

If so, as a replacement for FTP, you might try something like WinSCP,
for Windows PCs.  It is sort of like SFTP except it uses only SCP.

>From a user interface point of view, it looks and works just like any

other FTP application except it is much more secure.

It took me a while to get the clients on my various servers up to
speed on using SCP but once that was done, I was able to firewall FTP
and get rid of that security threat easily.

Craig

On Jul 23, 7:48 am, webado wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 22 2007, 8:31 pm
From: webado
Date: Mon, 23 Jul 2007 00:31:50 -0000
Local: Sun, Jul 22 2007 8:31 pm
Subject: Re: htaccess and user agent question
No  shell access.
Just  Cpanel access but uploads that way are the pits, especially with
Cpanel 11 we got which is quite peculiar. A clien tof mine managed to
delete her public_html folder when she anted to delete somehtign she's
uplaod by mistake there. No idea how she managed but she did.

On Jul 22, 8:22 pm, cass-hacks wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
djc  
View profile  
 More options Jul 22 2007, 9:55 pm
From: djc
Date: Sun, 22 Jul 2007 18:55:56 -0700
Local: Sun, Jul 22 2007 9:55 pm
Subject: Re: htaccess and user agent question
I was working on a file and uploaded to the wrong folder.  That's
probably when you got the index.asp.  Can you try it again to make
sure it's not downloading.  If it is, let me know what browser you are
using.

 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
djc  
View profile  
 More options Jul 22 2007, 9:59 pm
From: djc
Date: Sun, 22 Jul 2007 18:59:35 -0700
Local: Sun, Jul 22 2007 9:59 pm
Subject: Re: htaccess and user agent question
I've started using RDS for servers and NP for hosted sites.  I have a
flash drive mapped and transfer first to that, then reformat it each
time I'm done.

On Jul 22, 7:31 pm, webado wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
djc  
View profile  
 More options Jul 22 2007, 10:17 pm
From: djc
Date: Sun, 22 Jul 2007 19:17:38 -0700
Local: Sun, Jul 22 2007 10:17 pm
Subject: Re: htaccess and user agent question

>On a properly configured Apache server the .htaccess file is inaccessible to  http access

That's what I thought....kind of like .Net's web.config or classic
ASPs global.asa

So I guess I'm not understanding what a bot sending "post"
to .htaccess could possibly do.

I wonder since I use  Windows servers and there is supposed to be
something I can install and then use .htaccess, if this could be an
attempt to find windows servers with whatever it is
installed.....maybe whoever created the thing found a security hole.
Then again, the fellow in the other thread did have his altered.  I
wonder if he was ever able to find anything in his server logs.


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 22 2007, 10:55 pm
From: webado
Date: Mon, 23 Jul 2007 02:55:53 -0000
Local: Sun, Jul 22 2007 10:55 pm
Subject: Re: htaccess and user agent question
He semed to think it was through the phpbb forum and that is very
possible, it's the forum package that's been most hacked, despite
numerous upgrades.

The thing is if anybody did get into the forum under his identity
(through some iscript injection) then they'd know the home directory
path from the forum settings and could theoretically at least upload a
script to the phpbb forum attachements uploads area, execute it and
that script could modify the .htaccess file at the root level.
Lots of ifs.

Migth even be easier than that if Apache is installed with looser
security features like without open_basedir, the addressing up and
down the directory tree is less restricted.
But only speculation at this point. The truth might be something much
more mundane like somebody actually getting a hold of the userid  and
password and going straight there.

On Jul 22, 10:17 pm, djc wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 22 2007, 10:58 pm
From: webado
Date: Mon, 23 Jul 2007 02:58:23 -0000
Local: Sun, Jul 22 2007 10:58 pm
Subject: Re: htaccess and user agent question
Still downloading index.asp .
I'm using IE7 in Win XP pro.

On Jul 22, 9:55 pm, djc wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 22 2007, 11:26 pm
From: webado
Date: Mon, 23 Jul 2007 03:26:09 -0000
Local: Sun, Jul 22 2007 11:26 pm
Subject: Re: htaccess and user agent question
It works OK in Firefox, I think - though I cannot view the source code
of the page, I am informed that it contains POST data which has
expired.

On Jul 22, 10:58 pm, webado wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
djc  
View profile  
 More options Jul 23 2007, 12:31 am
From: djc
Date: Sun, 22 Jul 2007 21:31:52 -0700
Local: Mon, Jul 23 2007 12:31 am
Subject: Re: htaccess and user agent question
That is so strange.  I have XP Pro and it works in IE7, FF and
Netscape.  Do you get the asp code or the HTML?

ahhh, I bet it's sending the text results which in asp would take the
script name.  Let me know if that's all it is.  If it's the asp code,
then I have a major server problem.  If it's the text result, then
that's an IE setting and I can change the content type.  The main
reason I put it online so I don't have to keep telling people it's me
they see in their server logs.

On Jul 22, 9:58 pm, webado wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 23 2007, 12:37 am
From: webado
Date: Mon, 23 Jul 2007 04:37:36 -0000
Local: Mon, Jul 23 2007 12:37 am
Subject: Re: htaccess and user agent question
I'm getting plain text actually, but the file is called index.asp .

On Jul 23, 12:31 am, djc wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 23 2007, 12:38 am
From: webado
Date: Mon, 23 Jul 2007 04:38:15 -0000
Local: Mon, Jul 23 2007 12:38 am
Subject: Re: htaccess and user agent question
You got it: all text :)

On Jul 23, 12:31 am, djc wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 23 2007, 12:43 am
From: webado
Date: Mon, 23 Jul 2007 04:43:19 -0000
Local: Mon, Jul 23 2007 12:43 am
Subject: Re: htaccess and user agent question
You need to send it as:
Content-Type: text/plain

On Jul 23, 12:38 am, webado wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
djc  
View profile  
 More options Jul 23 2007, 9:49 am
From: djc
Date: Mon, 23 Jul 2007 06:49:38 -0700
Local: Mon, Jul 23 2007 9:49 am
Subject: Re: htaccess and user agent question
Content-Type: text/plain is what it's sending.

I couldn't sleep last night so I started on my .Net app. at 3 AM.
Couldn't get it to work in .Net but did get it to work in php but the
server times out (but not at local host)

checks for 200 - if found, checks all links on the page, follows to
pick up their status, then validates per doctype with w3c

301 - captures 301 and follows, posts links & status until it receives
a 200

On Jul 22, 11:43 pm, webado wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 23 2007, 10:32 am
From: webado
Date: Mon, 23 Jul 2007 14:32:49 -0000
Local: Mon, Jul 23 2007 10:32 am
Subject: Re: htaccess and user agent question
Gaaa, you've been busy :) Nothign like pulling an all-nighter ;)

Hope you got your caffeine fix :)

Would it be easier to write the generated output to a temporary file
with a fixed name , close it  and then include it by SSI of sorts into
an html page, between <pre> ..</pre> tags  and output that page, and
delete the file at the end? A bit of hassle with  some unique file
name id, but doable I think.

On Jul 23, 9:49 am, djc wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
djc  
View profile  
 More options Jul 23 2007, 4:19 pm
From: djc
Date: Mon, 23 Jul 2007 13:19:02 -0700
Local: Mon, Jul 23 2007 4:19 pm
Subject: Re: htaccess and user agent question
I should have had MORE figgin coffee.  I used text/plain in case my
htaccess was hacked.  I am on a windows server! GEEZZZZZZZZz.  Now it
returns text/html using xmp to prevent the html, javascript etc. from
running.

My link checker is now also working with the exception of the w3c
validation...in php rather than .Net but maybe next time I take a look
at that, I'll find some oh so obvious error.

On Jul 23, 9:32 am, webado wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
webado  
View profile  
 More options Jul 23 2007, 5:08 pm
From: webado
Date: Mon, 23 Jul 2007 21:08:16 -0000
Local: Mon, Jul 23 2007 5:08 pm
Subject: Re: htaccess and user agent question
Yay, it worked :)

(*mental note to check out xmp ...not familair with that - I use a
home-brewed script  to sanitize any html, php, js that I may find in
user input .. *)

On Jul 23, 4:19 pm, djc wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
End of messages
« Back to Discussions « Newer topic     Older topic »