5

I am not asking how. I am asking if. Is it possible to bypass a 403 error on the web?

Let me explain a bit in detail. On a web server the IIS has set up a directory for a project we are such that it is not accessable to the outside. So if you type the path to that directory in a web browser, the web browser will say that it is not accessable and it will throw a 403 error.

Now, here is the problem. Some files are placed there with some secure information. A programmer on our team has made a big deal about this and the fact that the files are placed on a server that is accessalbe to the outside world. On the other hand, I think this is not such a big deal since if a user on the outside tried to go to that directory, his web browser will throw the 403 error. But other people on the team say that a hacker can still somehow access it.

So that leads me here and to my question. Is it possible to bypass a 403 error on the web? I say no. Some network guys at work say maybe. I am not asking how to do it. I am only asking if it is really possible.

xarzu
  • 8,657
  • 40
  • 108
  • 160
  • Yes, it is possible. It's possible that an attacker is able to guess credentials or exploit a bug in the web site or in IIS itself to gain access. What the likelihood is depends on how well secured the site is. Particularly, how good the defense in depth is (firewalls, IDS, IPS and patching strategies all play a part). – Steve Nov 26 '13 at 08:59

4 Answers4

3

I gather from your information that there is a web server with a directory setup on the web like so

http://www.example.com/directory

Now, if you navigate to this URL you get a 403 Forbidden error? However, if you know the name of a file you can go to http://www.example.com/directory/MyImportantDocument.docx and it is possible to view the document at this location?

Unless there is a runnable script on your server that does this, it is not possible to view the directory contents via the web. However, URLs are not considered secure as they are logged in browser history, proxy and server logs and can also be leaked by browsers' referer header. I assume the files are stored here so they can be accessed by a remote application?

File names can be easily brute forced by an attacker. Tools such as dirbuster and dirb do this automatically. Therefore, if the files do not need to be readable remotely, they should be moved to an internal server, not accessible from the internet or DMZ.

If access is needed you should implement some sort of authentication. At the very least activate basic auth on IIS. This will prompt a web browser user for a username and password in order to view files, or the files can be accessed programmatically by setting the appropriate Authorization header, which is an encoded username and password.

Better would be something with comprehensive session management, like an application pre-built for this purpose. E.g. a CMS which is kept up-to-date and securely configured.

Also you should make sure that the IIS website is only configured to be accessed via HTTPS which will protect against traffic snooping of the credentials, URL path, headers and file contents.

SilverlightFox
  • 32,436
  • 11
  • 76
  • 145
3

In some cases (e.g. Back-end or web server mis-configuration) it's possible to bypass 403. For understanding those methods read this script:

https://github.com/lobuhi/byp4xx

this script contained well-known methods and collected from various bug bounty communities.

So if your back-end server not vulnerable to this script, probably it's safe.

Milad Fadavvi
  • 71
  • 5
2

So basically it is NOT possible if the server software itself doesn't has any bug. But if you have other parts of your website that are public and probably using a dynamic scripting language that may higher your risk if someone is able to find a hole with something like "access file from filesystem". In general I would recommend you to NOT store any security relevant files on a public server that don't need to! If you could avoid it, it's always the better way.

dibi
  • 3,257
  • 4
  • 24
  • 31
-5

There is a simple exploit to bypass .httacess restrictions... Try to Google "bypass error 403" and you will find the method. As auditor I can confirm that it is not a good practice (and if I see it I will always raise it as an issue) if you store credentials (or any other sensitive information) in plain text on web server.

TPAKTOPUCTA
  • 1
  • 6
    Googling that brought me back here. – Auberon Aug 22 '16 at 13:10
  • 1
    Google results change from time to time and is almost always different for each person (how much different it is varies), so your suggested "method" is quite ambiguous. Can you give us a simple link to the "answer" at least? – Reality Mar 10 '21 at 20:57