Lσgιη Iғ Yσυ Aяε α Mεмвεя


Rεgιsтεя Tσ Bε Mεмвεя Oғ Tнιs Fσяυм
Google Translater
IP Address
You are from
%%v_FLG%% %%v_IP%%
%%v_CR%% ,%%v_RG%%, %%v_CI%%
%%v_OS_IMG%% %%v_OS%%
%%v_BRW_IMG%% %%v_BRW%%
%%v_I_RESO%% %%v_RESO%% %%v_I_CLR%% %%v_CLR%%
Who is online?
In total there is 1 user online :: 0 Registered, 0 Hidden and 1 Guest


Most users ever online was 6 on Thu Jun 13, 2013 4:48 pm

What is HTTP Header Injection Vulnerability

Go down

What is HTTP Header Injection Vulnerability

Post by Administrator on Thu Jul 04, 2013 6:22 pm

HTTP Header
HTTP Header is the component of HTTP requests and responces. Header fields are transimitted with each request and responce and carry additional data about the requests and responces.
See the typical request and responce headers Here at Web-Sniffer.net

HTTP header injection
HTTP header injection is a kind of web application vulnerability which exists on those web applications that generatd HTTP headers based on the input given by users. If it uses User based input in the headers, it can be used for HTTP response splitting, cross-site scripting (XSS), Session fixation via the Set-Cookie header, and malaicious redirects attacks via the location header.

[You must be registered and logged in to see this image.]

I recently found a similar kind of vulnerability in [You must be registered and logged in to see this link.] and for this I was also acknowledged by Apple on its website.

It used apache 1.3.33 that was vulnerable to the HTML and malicious javascript injection through  "Expect" header.

See the responce header of the website:
GET / HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: canadaedu.apple.com
Cookie: PHPSESSID=3b8026225d719c6945155129c5c7335d
Connection: Close
Expect: alert(411731119275)
Pragma: no-cache
The alert box added in the Expect field could be injected for Cross Site Scripting.

Posts : 239
Join date : 2013-05-29
Age : 30
Location : India


Back to top Go down

Back to top

Permissions in this forum:
You cannot reply to topics in this forum