Utilizing .htaccess for Exploitation Purposes

If you can write a .htaccess file to a directory on an Apache server, you effectively control how that directory behaves. Most exploitation guides treat .htaccess as a footnote. It deserves more attention.

These techniques assume AllowOverride All or at least AllowOverride FileInfo AuthConfig in the server config. This is the default on most shared hosting and many self-managed setups.

Rewrite-based persistence

Hide a payload behind a custom header. Normal visitors see the legitimate page. Requests with your magic header get routed to the backdoor.

RewriteEngine On
RewriteCond %{HTTP:X-Debug-Token} ^s3cr3tK3y$
RewriteRule ^index\.php$ /uploads/.cache.php [L]

Without the header, Apache serves index.php normally. With it, Apache internally rewrites to your shell. No redirect, no visible URL change, nothing in access logs that looks unusual.

Credential harvesting via forced BasicAuth

Drop an .htaccess in a directory that forces HTTP Basic Authentication. Users submit credentials in plaintext (base64, effectively plaintext) which get logged or forwarded.

AuthType Basic
AuthName "System Maintenance - Please Re-authenticate"
AuthUserFile /dev/null
Require valid-user

Since AuthUserFile points to /dev/null, no credentials will pass validation. But the submitted credentials are available in server variables. Combine with a RewriteRule that captures %{HTTP:Authorization} and writes it to a file.

IP-based payload delivery

Serve different content to your IP versus everyone else. Useful for maintaining access while the site looks clean to the defenders.

RewriteEngine On
RewriteCond %{REMOTE_ADDR} ^10\.0\.0\.50$
RewriteRule ^logo\.png$ /uploads/.shell.php [L]

PHP execution via AddType

Turn any file extension into an executable PHP file. Bypasses upload filters that block .php extensions.

AddType application/x-httpd-php .jpg
AddHandler php-script .jpg

Now upload profile.jpg containing PHP code. Apache executes it as PHP. File extension checks pass, content-type checks pass if you prepend valid JPEG headers (the PHP interpreter ignores them).

Uploading the .htaccess itself

Most upload filters check for dangerous extensions like .php, .phtml, .pht. Many forget about .htaccess. If the application stores uploads in a web-accessible directory with no filename sanitization that strips dots from the beginning, you can upload .htaccess directly.

If the filename is sanitized, try:

• Double extensions: .htaccess.jpg (some sanitizers strip only the last extension)
• Null byte injection (legacy PHP): .htaccess%00.jpg
• Unicode normalization: fullwidth period + htaccess

Detection notes

From a blue team perspective: monitor for .htaccess file creation/modification outside of deployment processes. Use AllowOverride None wherever possible. If overrides are required, restrict to the minimum needed directives. File integrity monitoring should explicitly include dotfiles.