0

I have an old website that I created a folder that's protected with htpasswd. However, it's over a decade old, and I have since forgotten the password. I wish to access the contents of the folder. I'm able to view the directory contents via the control panel, but I'm unable to access the individual protected files.

I have access to the htpasswd file, and it has lines of user:password, where the password seems to be hashed (13 characters, uppercase/lowercase/digits). I tried loading it into John and it detects it as CRYPT, but was unable to crack it even after a few hours. Are there better ways of accessing the files? Given server access, can I reset/remove the password protection? Or, failing that, are there better/faster ways of brute forcing the password hash?

1 Answer 1

2

So you have SSH access to the server, but don't remember the values used to generate the passwords stored in the htpasswd file so you can't access them via control panel?

You could just login and rename (disable) the .htaccess file:

$ mv protected_dir/.htaccess protected_dir/.old.htaccess

If you want to crack the old password first read this: https://www.slashroot.in/how-are-passwords-stored-linux-understanding-hashing-shadow-utils to understand the password format.

Then basically you can use John, but you have to take the password file and append the salt to each password.

$ john --wordlist=passwd_salted.txt passwords_to_crack.txt

Good luck!

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.