Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Note: I know how HTTP Splitting works.

Note 2: I am not working in WebGoat. I am trying to make this on my own.

I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this php code:

<?php
header("Location: " . $_GET['page']);
?>

And then I enter the following URL:

http://localhost/webgoat/httpsplitting.php?page=index%0aContent-Length:%200%0a%0aHTTP/1.1%20200%20OK%0aContent-Type:%20text/html%0aContent-Length:%2017%0a%0a<html>Hacked</html>

But then also when I intercept the request using webscarab, I see that these headers are not included in the web server's response.

Additionally I saw in wireshark that the LF sequence (i.e. %0a) is not converted into its ASCII format and is used as a string and not as a line feed.

So, I came to the deduction that modern web servers are not susceptible to this attack. Am I correct ??

share|improve this question

3 Answers 3

up vote 2 down vote accepted

This it not an issue with your browser, but instead an issue with the PHP header function being immune to HTTP splitting attacks. The same goes for set-cookie function call.

You can read more about this here http://stackoverflow.com/questions/6287713/is-php-immune-to-http-response-splitting-vulnerabilities

A short excerpt:

 [...] Although response splitting is not specific to PHP, the PHP interpreter 
contains protection against the attack since version 4.4.2 and 5.1.2. [1]
share|improve this answer

Doesn't look like a browser issue: if the server accepts a newline in input, and spits that straight out into an HTTP header without escaping that would be purely server-side vulnerability.

This particular header-splitting attack is now mitigated in PHP itself. The header() function will give you an error if you pass a string with a newline in.

share|improve this answer

HTTP Splitting attacks are focused on server side as consequence of a bad input parsing and vulnerable functions. For a browser it is impossible to guess when a header is bad or not. These are sent by the server.

Probably you read this OWASP HTTP Response Splitting

HTTP response splitting occurs when: Data enters a web application through an untrusted source, most frequently an HTTP request. The data is included in an HTTP response header sent to a web user without being validated for malicious characters.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.