In this bash basics HakTip we’re downloading files from .htaccess protected web directories without storing the password in the bash history.

Download HD Download MP4

In this bash basics HakTip we’re downloading files from .htaccess protected web directories without storing the password in the bash history.
We’ll begin by issuing the history command. This useful tool is useful for reusing previously issued commands. In its default form it’ll simple dislpay the last commands used. The same could be achieved with cat ~/.bash_history.

While it’s nice that this history is here, and while we could use history control commands to limit what goes in, I find it easier to specify passwords into temporary variables when using them in plain-text commands.

For example, if I were trying to download secret.jpg from http://www.twitterphishr.com/hiddenstuff/ I could issue wget –user darren –password lamepassword http://www.twitterphishr.com/hiddenstuff/secret.jpg and the file would download, but now I have my password stored in plain text.

You’re probably also thinking to yourself, but wait he’s downloading from HTTP rather than HTTPS so it doesn’t matter — it was plain-text in transit — and you’re absolutely right. Now stop pestering me with technicalities and enjoy the technique that is storing passwords in temporary variables

To substitute our plain-text password with our variable one, we’ll first need to define it. To do so issue read -e -s -p “pass?” password

The important bit here is the -p which tells read to use an interactive prompt, in our case “pass?”, for the variable “password”.

With our variable newly created and for illustrative purposes we can test to see that it actually has the value with the echo command so I’ll issue echo $password.

Now to string it together with wget I’ll issue wget –user darren –password “$password” http://www.twitterphishr.com/hiddenstuff/secret.jpg and there you have it — the secret file has been obtained and if I run history you won’t see my lame password anywhere!

Now it should be noted that with wget version 1.12 the –ask-password opiton was added, but if you’re on a system with an older version of wget I hope this comes in handy. And obviously this can be adapted to more than just wget, so I’m interested in hearing how you go about dealing with this sort of issue.

Ok, so I want to hear your feedback. What apps do you use? Let me know what you think or what apps to check out by emailing me — tips@hak5.org or send me a note in the comments below.

And be sure to check out our sister show, Hak5 for more great stuff just like this.

What program do you use? Hit me up in the comments or email me — tips@hak5.org.

And be sure to check out our sister show, Hak5 for more great stuff just like this.