Re: [PEN-TEST] HTML source code and authentication

[Martijn Prummel <punisher () ZEGMAAR NL>]

Chris Tobkin wrote:
> > click SUBMIT, but the Hidden Fields are Bad Thing (tm).

Agreed. I wouldn't use forms for authentication at all.
We also have a thing called HTTPAuth :)
Just add a http_auth_required header.
This means a 401 webserv response with a header called
WWW-Authenticate: basic realm="Blahblah"

This will popup a browser window asking for user/pass. The content
of this can be read by looking into the auth header sent back to the
server. This is MIME64 encoded, so not too hard :)

Grtz,
Martijn
--
# whatis life
life: nothing appropriate