If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?

  • The header would be encrypted ... – schroeder May 15 '19 at 15:34
  • Therefore one can say that it is impossible to do http header injection or any other related http header attack on https right? – Coding_A_Nation May 15 '19 at 15:40
  • By a MitM, yes (assuming the TLS connection is secure, or course). It does nothing for broken clients, obviously. – Peter May 15 '19 at 15:44
  • @Coding_A_Nation Correct. If the attacker cannot downgrade the connection to HTTP, they cannot inject content. – Xander May 15 '19 at 15:44
  • that meanst you need to use https with HSTS http strick security transport to prevent downgrading attacks and MitM. Thanks guys. – Coding_A_Nation May 16 '19 at 7:34

Yes it is possible, but only in certain cases. There are two general classes of Header Injection attacks that I am aware of:

One is a Man-in-the-Middle (MITM) attack where someone is intercepting your traffic to inject header info. HTTPS connections protect against these.

The second is a Cross-Site Script (XSS) attack. These are attacks against an application level vulnerability where a user of a website can use his input to affect the way that headers are dynamically created for other users. With XSS attacks, you change the way the server parses what it's sending you before it is encrypted for transmission; thus the content can be modified.

An example of this vulnerability might look like:

  ... // functions and SQL to collect $resultHeader and $resultHTML parameters from your database.
  $header = buildHeader($resultHeader); 
  $html = buildHTML($resultHTML);
  echo $header;
  echo $html;

Since the buildHTML() function processes before the $header variable is written to the page, a PHP injection could rewrite $header before it is echoed.

| improve this answer | |
  • How exactly does XSS "change the way the server parses what it's sending you"? – AndrolGenhald May 21 '19 at 22:10
  • Most websites use a backend language such as PHP to build a page's HTML and JS. A poorly validated system could allow a PHP injection to interfere with how the page's JS and HTML are assembled meaning that it can change the HTML header in the process of building the page. Much like SQL injections, modern language standards and frameworks make XXS header attacks mostly a thing of the past, but you still sometimes get poorly built systems that don't explicitly declare their HTML headers before allowing user inputs to process. – Nosajimiki May 22 '19 at 17:34
  • It sounds like you're talking about some sort of server-side code injection. XSS is client-side. – AndrolGenhald May 22 '19 at 17:57
  • XSS can be both: stackoverflow.com/questions/28392997/server-xss-vs-client-xss. At its heart, an XSS attack is just an attack where one end user can inject code for another end user to execute. – Nosajimiki May 22 '19 at 18:03
  • AndrolGenhald if he is talking about server-side code injection that sounds like cross-site request forgery attack. – Coding_A_Nation May 22 '19 at 19:07

For all protocol level attacks, that is HTTP splitting and cache poisoning using headers injections via bad HTTP syntax parsing (HTTP Smuggling), the TLS protection would not protect you. HTTP protocol is encapsulated in the TLD/SSL layer, but at the end the parser will read an HTTP message, as if no encryption was done. The TLS layer protects the message while it's traveling, not when an HTTP actor is parsing it.

At least the TLS adds some complexity on the attacker side, where a tool supporting TLS (like openssl_client) has to be used and not very simple socket connections tools like telnet or netcat. Nothing that cannot be done.

There is also headers injection via application errors, usually via CRLF injections on query arguments. Here again TLS protection adds very few protections.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.