1

Note: I know how HTTP Splitting works.

Note 2: I am not working in WebGoat. I am trying to make this on my own.

I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this php code:

<?php
header("Location: " . $_GET['page']);
?>

And then I enter the following URL:

http://localhost/webgoat/httpsplitting.php?page=index%0aContent-Length:%200%0a%0aHTTP/1.1%20200%20OK%0aContent-Type:%20text/html%0aContent-Length:%2017%0a%0a<html>Hacked</html>

But then also when I intercept the request using webscarab, I see that these headers are not included in the web server's response.

Additionally I saw in wireshark that the LF sequence (i.e. %0a) is not converted into its ASCII format and is used as a string and not as a line feed.

So, I came to the deduction that modern web servers are not susceptible to this attack. Am I correct ??

2

This it not an issue with your browser, but instead an issue with the PHP header function being immune to HTTP splitting attacks. The same goes for set-cookie function call.

You can read more about this here https://stackoverflow.com/questions/6287713/is-php-immune-to-http-response-splitting-vulnerabilities

A short excerpt:

 [...] Although response splitting is not specific to PHP, the PHP interpreter 
contains protection against the attack since version 4.4.2 and 5.1.2. [1]
0

Doesn't look like a browser issue: if the server accepts a newline in input, and spits that straight out into an HTTP header without escaping that would be purely server-side vulnerability.

This particular header-splitting attack is now mitigated in PHP itself. The header() function will give you an error if you pass a string with a newline in.

0

HTTP Splitting attacks are focused on server side as consequence of a bad input parsing and vulnerable functions. For a browser it is impossible to guess when a header is bad or not. These are sent by the server.

Probably you read this OWASP HTTP Response Splitting

HTTP response splitting occurs when: Data enters a web application through an untrusted source, most frequently an HTTP request. The data is included in an HTTP response header sent to a web user without being validated for malicious characters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.