HTTP header injection: Difference between revisions

Revision as of 19:15, 5 February 2015

Revision as of 21:15, 5 February 2015

Line 1:

{{HTTP}}

'''HTTP header injection''' is a general class of [[web application]] [[security vulnerability]] which occurs when [[Hypertext Transfer Protocol]] (HTTP) [[list of HTTP headers|headers]] are dynamically generated based on user input. Header injection in HTTP responses can allow for [[HTTP response splitting]], [[Session fixation]] via the Set-Cookie header, [[cross-site scripting]] (XSS), and malicious redirect attacks via the ___location header. HTTP header injection is a relatively new area for web-based attacks, and has primarily been pioneered by Amit Klein in his work on request/response smuggling/splitting{{fact|date=February 2015}}.

== Sources ==

* [http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042358.html HTTP Response Smuggling]{{Citation broken|date=June 2014}}

* [http://palisade.plynt.com/issues/2006Sep/http-request-smuggling/ HTTP Request Smuggling]{{Citation broken|date=February 2015}}

* [http://www.webappsec.org/lists/websecurity/archive/2008-04/msg00003.html File Download Injection]