Howlsec
HOWLSEC
offensive security
// notes/ Web Exploitation
🍪

HTTP Headers & Cookies

Security-relevant request/response headers, cookie flags, and header-based attacks.

#headers#cookies#web

HTTP Headers & Cookies

Cookie attacks

++Cookie header attacks:++

Can sometimes be used for auth bypassing: Cookie: SessionToken=anything

Just play around with, sometimes the server can expect an LFI even through it, see responses Cookie: name=<script>alert(document.domain)</script> Cookie: name=../../../../../../../../etc/passwd Cookie: name=../../../../../../../../etc/passwd%00

python jsonpickle

see symfonos4 box notes to see examle

“jsonpickle is a library for the two-way conversion of complex Python objects and JSON” “jsonpickle is a Python library for serialization and deserialization of complex Python objects to and from JSON.”

See python jsonpickle

Host Injection

Host Header Injection: https://youtu.be/8wT1DWxCOgc?t=1

  1. Bypass 403 response Host: localhost

  2. Redirect request to alternate site Host: bing.com

  3. Redirect request to alternate site Insert: X-Forwarded-Host: bing.com

Impact: It can poison the cache of the web application as well as the proxy. When authorized users tries to access the host, the user gets redirected to the alternate domain due to the poisoned cache of the initial webserver.