4


Have you ever seen HTTP Response Splitting in laboratory environment?

There are many examples for HTTP Response Splitting vulnerability.

I used old PHP and managed to get 2 responses from server that are visible in wireshark:

HTTP/1.1 302 Found
Date: Sun, 30 Aug 2015 11:56:15 GMT
Server: Apache/2.0.47 (Win32) mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.3RC2-dev
X-Powered-By: PHP/4.3.3RC2-dev
Location: 
Content-Length: 0

HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 25

<html>Hacked !</html>
Content-Length: 0
Content-Type: text/html; charset=ISO-8859-1

If I render it in BurpSuite then I see html from second response, but the browser does not show it and has different behaviour instead depends on browser.

When I look at the response in Live HTTP Headers extension for FireFox I see that the string "HTTP/1.1 200 OK" is absent.

enter image description here

How is it possible to see HTTP Response Splitting for Location header in browser?

Improve this question
5
  • 2
    Your question is not clear at all. How many responses do you see in Burp? Does the client send another request after the 302 to get a 200 as a reply? (Is it even 2 different responses in Wireshark or is the 200 the data of one single response?) Why exactly do you expect to see the HTTP code as a string in your browser? You should include screenshots and/or clarify your steps if you want people to be able to help you.
    – Dillinur
    Commented Aug 31, 2015 at 11:17
  • 1
    Are you using a proxy? Firefox is probably taking the first response. If you use a proxy, maybe that will take the second response. That way you can poison the cache for the URL so that further requests get your doctored page.
    – SilverlightFox
    Commented Aug 31, 2015 at 12:04
  • Dear collegues, thank you for your replies. My client's browser may send another request for the same link or may send another request for "/" or may keep silence, it depends on browser (IE with different versions, FireFox from 3 to 40, Opera). But my browser never shows injected HTML code that is contained in the second (200 OK) response as expected. I guess I should configure my proxy server to cache the rendered response from server. SilverlightFox, could you recommend some proxy that is able to cache rendered response?
    – Sergey Klevogin
    Commented Aug 31, 2015 at 17:38
  • Try setting a cookie instead of the content type.
    – Jeroen
    Commented Sep 1, 2015 at 6:00
  • Hi, Jeroen! I set cookie successfully after <cr><lf> injection but the second answer (HTTP/1.1 200 OK) is still absent on the browser side in Live HTTP Headers extension, although this header is visible in wireshark on the client side.
    – Sergey Klevogin
    Commented Sep 1, 2015 at 6:19

1 Answer 1

Reset to default
1

For attacks using applications flaws, like in your example, the goal is to feed the content of the 302 response (with an empty location and a real HTML content. So the first response, the 302 response, will not have a Content-Length: 0. Put the 'hacked' in this 302 page, with a length. No location is given so the redirection will fail. The next response (the official response) is discarded. In this mode you do not care about the second response.

A browser behavior on receiving a response for something not yet requested is quite hard to predict. Unless HTTP pipelining is used on the browser this response would be simply ignored.

But the target of HTTP response splitting attack is not always the browser.

Such issues can be used for complex cache poisoning attack. The attacker will build the pipeline of queries (usually without a browser), so that the second query will get the extra response and could be poisoned in a cache.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .