I was practicing on one of the open source penetration testing frameworks bWAPP. I came across this code,

 $url = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"];
 echo $url;

I was able to find out a vulnerability in it. By using proxy, I was able to modify the HOST parameter in request body, I was able to reflect the same in my page. But, when I enter JS code or HTML code, I get an error BAD Request. So, my first question, Is this really a vulnerability ?

On moving to intermediate level, I discovered this piece of code, which was based on JS.

$url = "<script>document.write(document.URL)</script>";
echo $url;

Now, here I am not able to find any vulnerabilities with this piece of code. I was able to prevent it from displaying, by turning off my Javascript in my browser. But, since it is not accepting any value from the user and JS based and running on client side, I wonder if there is a possibility of XSS.


Both codes are vulnerable, but neither is exploitable with most modern browsers.

In the first example, could exploit the echoing of REQUEST_URI. Exploitability depends on the browser not automatically encoding values before sending the request (see XSS via REQUEST_URI). Host Header Injection may also be possible.

In the second example, the code is accepting input from the user via document.URL. This is called DOM based XSS (but modern browsers will most likely URL-encode the URL, so exploitation may not be possible).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.