What is HTTP Header Injection Vulnerability Glitterfy3033310T584B81
Lσgιη Iғ Yσυ Aяε α Mεмвεя

Oя

Rεgιsтεя Tσ Bε Mεмвεя Oғ Tнιs Fσяυм


Join the forum, it's quick and easy

What is HTTP Header Injection Vulnerability Glitterfy3033310T584B81
Lσgιη Iғ Yσυ Aяε α Mεмвεя

Oя

Rεgιsтεя Tσ Bε Mεмвεя Oғ Tнιs Fσяυм
Would you like to react to this message? Create an account in a few clicks or log in to continue.

Google Translater
IP Address
You are from
%%v_FLG%% %%v_IP%%
%%v_CR%% ,%%v_RG%%, %%v_CI%%
%%v_OS_IMG%% %%v_OS%%
%%v_BRW_IMG%% %%v_BRW%%
%%v_I_RESO%% %%v_RESO%% %%v_I_CLR%% %%v_CLR%%
Who is online?
In total there is 1 user online :: 0 Registered, 0 Hidden and 1 Guest

None

Most users ever online was 17 on Mon Nov 13, 2023 12:55 am
Visitors

What is HTTP Header Injection Vulnerability

 :: Security :: Information And Security

Go down

What is HTTP Header Injection Vulnerability Empty What is HTTP Header Injection Vulnerability

Post by Administrator Thu Jul 04, 2013 6:22 pm

HTTP Header
HTTP Header is the component of HTTP requests and responces. Header fields are transimitted with each request and responce and carry additional data about the requests and responces.
See the typical request and responce headers Here at Web-Sniffer.net

HTTP header injection
HTTP header injection is a kind of web application vulnerability which exists on those web applications that generatd HTTP headers based on the input given by users. If it uses User based input in the headers, it can be used for HTTP response splitting, cross-site scripting (XSS), Session fixation via the Set-Cookie header, and malaicious redirects attacks via the location header.

[You must be registered and logged in to see this image.]

I recently found a similar kind of vulnerability in [You must be registered and logged in to see this link.] and for this I was also acknowledged by Apple on its website.

It used apache 1.3.33 that was vulnerable to the HTML and malicious javascript injection through  "Expect" header.

See the responce header of the website:
GET / HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: canadaedu.apple.com
Cookie: PHPSESSID=3b8026225d719c6945155129c5c7335d
Connection: Close
Expect: alert(411731119275)
Pragma: no-cache
The alert box added in the Expect field could be injected for Cross Site Scripting.
Administrator
Administrator
Admin

Posts : 239
Join date : 2013-05-29
Age : 35
Location : India

https://saudatricks.forummotion.com

Back to top Go down

Back to top

- Similar topics

 :: Security :: Information And Security

 
Permissions in this forum:
You cannot reply to topics in this forum