1

Note: I know how HTTP Splitting works.

Note 2: I am not working in WebGoat. I am trying to make this on my own.

I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this php code:

<?php
header("Location: " . $_GET['page']);
?>

And then I enter the following URL:

http://localhost/webgoat/httpsplitting.php?page=index%0aContent-Length:%200%0a%0aHTTP/1.1%20200%20OK%0aContent-Type:%20text/html%0aContent-Length:%2017%0a%0a<html>Hacked</html>

But then also when I intercept the request using webscarab, I see that these headers are not included in the web server's response.

Additionally I saw in wireshark that the LF sequence (i.e. %0a) is not converted into its ASCII format and is used as a string and not as a line feed.

So, I came to the deduction that modern web servers are not susceptible to this attack. Am I correct ??

Improve this question

3 Answers 3

Reset to default
3

This it not an issue with your browser, but instead an issue with the PHP header function being immune to HTTP splitting attacks. The same goes for set-cookie function call.

You can read more about this here https://stackoverflow.com/questions/6287713/is-php-immune-to-http-response-splitting-vulnerabilities

A short excerpt: 

 [...] Although response splitting is not specific to PHP, the PHP interpreter 
contains protection against the attack since version 4.4.2 and 5.1.2. [1]
Improve this answer
0

Doesn't look like a browser issue: if the server accepts a newline in input, and spits that straight out into an HTTP header without escaping that would be purely server-side vulnerability.

This particular header-splitting attack is now mitigated in PHP itself. The header() function will give you an error if you pass a string with a newline in.

Improve this answer
0

HTTP Splitting attacks are focused on server side as consequence of a bad input parsing and vulnerable functions. For a browser it is impossible to guess when a header is bad or not. These are sent by the server.

Probably you read this OWASP HTTP Response Splitting

HTTP response splitting occurs when: Data enters a web application through an untrusted source, most frequently an HTTP request. The data is included in an HTTP response header sent to a web user without being validated for malicious characters.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .