Recently, I read a paper which describes an attack on http response protocol. The attack is called CRIME or CRIME Extensions. It exploits TLS compression algorithm by checking the total payload of http response after injecting some word into response message. As compression algorithm (DEFLATE in TLS) replaces same word into shorter length, the attacker can check if the injected word is the same with secret information in HTML response message.

Do HTML files have secret information? For example, in major websites such as Google or Facebook, after the TLS handshake, a client sends a HTTP request, like "send me my personal page", and the server sends a HTTP response that has very private information?

closed as unclear what you're asking by Neil Smithline, Polynomial, Ohnana, Matthew, Rory Alsop May 12 '16 at 18:19

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What do you mean by "secret"? There could be information that is "private" and only intended for the person receiving the information. There is also configuration data (eg: session ID) that is stored in cookies. This is used by the browser but not shown to the user (what would they do with it?). – Neil Smithline May 10 '16 at 4:19

describes an attack on http response protocol ... the attack is called CRIME ... html files have secret information?

CRIME is not about detecting secrets in the HTML file (which gets sent as the response from the server to the client) but about detecting the secrets in the request (sent from the browser to the server). Or as it is described in the related Wikipedia article:

relies on the attacker being able to observe the size of the ciphertext sent by the browser while at the same time inducing the browser to make multiple carefully crafted web connections to the target site.

And yes, there are secrets in the request, at least if you are logged into some site. Since HTTP is a stateless protocol by itself the "logged in" state is usually maintained by a session id stored inside a cookie. And if this cookie gets known to the attacker then it might be used for session hijacking, i.e. the attacker can do some actions using the identity of the victim.

Having access with a stolen identity might of course also be used to get access to secret information sent by the server to the alleged user. Such secrets can be private mails, credit card information...

Not the answer you're looking for? Browse other questions tagged or ask your own question.