1

This website has a header in the request (If-None-Match) and whatever you set the value to for it, the response will contain a header (ETag) with the value of the If-None-Match header.

I understand why it does that, but is there any possible exploit that could be performed with this reflection of a header value from request to response?

I attempted CRLF and it failed since the response header didn't decode URL encoding or Unicode entities in the request.

Improve this question
1

1 Answer 1

Reset to default
2

While I don't think there's any immediate vulnerabilities, it would still be good practice to check if the reflected value is properly filtered for XSS. It may be possible to chain other vulnerabilities that aren't immediately obvious. For example, there could be a part of the site that will use the If-None-Match header in the content, in which case you'd have an exploit if XSS isn't being filtered correctly.

If you're sure CRLF doesn't work, I'd just make a note of the reflection and continue digging around.

Improve this answer
2
  • So It's not properly filtering for XSS, and I noticed that in Chrome, that header's value is returned as the page body in the response for some odd reason (only in Chrome). So new question; any tool that could modify the header and send the request via Chrome so I could check for XSS?
    – Jack
    Commented Dec 2, 2018 at 0:24
  • 1
    @Jack that's interesting, not sure why it's happening in just Chrome. My two recommendations would be either Postman + Postman Interceptor, or downloading Burp Suite and following the manuals to configure it with Chrome.
    – Katerina Borodina
    Commented Dec 2, 2018 at 0:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .