HTTP Header Injection Discovery method (with case)

0x0: Overview

Author: Dark Month Blog: www.moonsec.com

With regard to this type of injection, the traditional web vulnerability scanner is basically for get/post injection .

The detection of this type of injection becomes powerless.

0x01: Discover

0x01.1: Common HTTP may be contaminated with these parameters

• User-agent browser version (less)
• Referer Source (less)
• X-forwarded-for get IP (High)
• CLIENT_IP get IP (High)

0x01.2: Discovery Tools

The author uses the Firefox browser to demonstrate first install the browser add-ons modify headers after installation Restart Firefox Select Web Development Selection tool, the following settings:

Need to detect user-agent Referre is also how to set, select Start to determine the browser will load these parameters every time you visit the site.

0x01.3: Vulnerability Discovery

There is a loophole here is usually logged in, there is a place to record browser information, according to the author of the past audit loopholes and fuzzy testing when the presence of IP records found in a particular place.

0X0.14: Vulnerability Code

Function getip () {    if (getenv (' http_client_ip '))    {        $ip = getenv (' http_client_ip ');    }       ElseIf (getenv (' http_x_forwarded_for '))    {//Get the real IP address of the client when accessing the proxy server        $ip = getenv (' http_x_forwarded_for ');    }    ElseIf (getenv (' http_x_forwarded '))    {        $ip = getenv (' http_x_forwarded ');    }    ElseIf (getenv (' http_forwarded_for '))    {        $ip = getenv (' http_forwarded_for ');    }    ElseIf (getenv (' http_forwarded '))    {        $ip = getenv (' http_forwarded ');    }    else    {        $ip = $_server[' remote_addr ');    }    return $IP;}

0x01.5: Vulnerability Demo

HTTP_CLIENT_IP first CLIENT_IP not get to select the X-forwarded-for diagram in Http_forwarded_for:

0x02 Case Reference:

1. Penetration DZ Official website
2. BLUECMS Injection Vulnerability

HTTP Header Injection Discovery method (with case)