HTTP header injection: Difference between revisions

Revision as of 04:32, 3 April 2016

Latest revision as of 10:05, 17 May 2025

(34 intermediate revisions by 24 users not shown)

Line 1:

{{Short description|Web application security vulnerability}}

Violations

{{Citation style|date=March 2024}}

{{HTTP}}

'''HTTP header injection''' is a general class of [[web application]] [[security vulnerability]] which occurs when [[Hypertext Transfer Protocol]] ([[HTTP]]) [[list of HTTP headers|headers]] are dynamically generated based on user input. [[Header (computing)|Header]] injection in HTTP responses can allow for [[HTTP response splitting]], [[session fixation]] via the Set-[[HTTP cookie|Cookie]] header, [[cross-site scripting]] (XSS), and malicious redirect attacks via the ___location header. [[XSS]] attacks can be blocked with the use of an [[Browser extension|extension]] such as [[NoScript]] or Malwarebytes Browser Guard on your [[Web browser|browser]].

== Sources ==

* [httphttps://listsdl.webappsecpacketstormsecurity.orgnet/pipermailpapers/websecurity_lists.webappsec.org/2008-Aprilattack/003692Aspect_File_Download_Injection.htmlpdf File Download Injection]

* [https://www.owasp.org/index.php/HTTP_Request_SmugglingHTTP_Response_Splitting OWASP HTTP request SmugglingSplitting]

* [https://www.owasp.org/index.phpwww-project-web-security-testing-guide/Testing_for_HTTP_Splittinglatest/Smuggling_%28OTG4-INPVALWeb_Application_Security_Testing/07-Input_Validation_Testing/15-016%29Testing_for_HTTP_Splitting_Smuggling OWASP Testing for HTTP Splitting/Smuggling]

* [httphttps://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/ HTTP Smuggling in 2015]

* [https://noscript.net NoScript Official Website]

== ToolsSee also ==

* [[HTTP request smuggling]]

* [http://wapiti.sf.net Wapiti Open Source Header, XSS, SQL and LDAP injection scanner]

==References==

Line 14 ⟶ 18:

[[Category:Web security exploits]]

[[Category:Hypertext Transfer Protocol]]

[[Category:Hypertext Transfer Protocol headers]]