I was messing around with my settings on a old D-LINK DIR-600 wireless router. I've been tweaking the settings a bit for various purposes. So when I recently go to type the first few digits of the IP address, but then autocomplete shows me the rest of the IP address because I've visited it a few times. I don't look at the ending of it, I just hit enter. Once I hit enter though, I realize that the adress was
192.168.0.1/index.asp and not just
192.168.0.1. When I enter the second link, it prompts me like normal for my password. However, when I click on the second link, it doesn't ask for a password. I get free access to the router, and I don't even need to hack anything!
Is this because Chrome has a cached copy and caches everything that's not HTTPS? Chrome says it's not encrypted, so is that just Chrome catching the copy? I don't mind if that's the case, but if not, it's a huge security exploit that if you can just log into a router (let's say no password) you can take over the whole network. Yes, it can be fixed with a simple factory reset using the button on the router, but still, it might be too late, especially if the neighbors hate you. :P
Everybody who I even let close to my router is careful with the password and probably doesn't even know what port forwarding is, but still, people hack routers a lot.