Bypass htaccess REQUEST_URL restriction

Viewed 239

I participated in a CTF last year that had the following .htaccess file:

RewriteEngine On
RewriteCond %{THE_REQUEST} filename
RewriteRule ".*" "-" [F]

And asked to request the resource http://website.com/folder/filename.txt. I think I've replicated the environment and still can't solve the problem. I've tried url encoding and content-disposition. I feel like the solution is straight forward but it still eludes me.

URL encoding example:

/folder/%66ilename.txt

If anyone can help me, or can find the writeup of last years French CTF, I would very much appreciate it. It was a problem that many people solved and I got stumped on.

0 Answers
Related