Our application was flagged by Netsparker as having a Web Cache Deception vulnerability.
the attacker uses the acquired link, for example
https://example.com/settings.php and appends a path with a file
extension, which may look like a static stylesheet or image.
The attacker would then send the manipulated link to the victim. Once
the victim's browser accesses the URL, it sends along the victim's
cookies. So the cache server would receive the request for example for
https://example.com/settings.php/stylesheet.css and will treat it as a
static stylesheet file. In many environments where aggressive caching
is needed to keep the number of requests to the server as low as
possible, the cache server may override the Cache-Control header sent
by the application and use the public cache control directive for all
files ending in .css. This means that the page will be cached for all
users of the site, even though its content belongs to a single user
and may contain sensitive data.
In our case, the scan tried
https://app.com/myapp//ns.css
and got some kind of result,
Response Time (ms) : 18.8747 Total Bytes Received : 3754 Body Length : 3321 Is Compressed : No
HTTP/1.1 200 OK
Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1k
Expires: Thu, 1 Jan 1970 00:00:00 GMT
Connection: keep-alive
Content-Length: 3321
Last-Modified: Tue, 31 Aug 2021 17:02:00 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Accept-Ranges: bytes
Pragma: no-cache
Content-Type: text/html
Date: Tue, 31 Aug 2021 19:32:23 GMT
Cache-Control: max-age=0, no-store, no-cache, must-revalidate
<!doctype html><html lang="en"><head><meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate"/><meta http-equiv="Pragma" cont
ent="no-cache"/><meta http-equiv="Expires" content="0"/><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta charset="utf-8"/><link rel="ico
n" href="/ets/favicon.ico"/>
But what should have been the result? A 404 error? We have a React application and the result was a blank page due to a mismatched route.
Related
I have an API name loginUser, which generates the authorization Token, that is to be passed in other subsequent APIs.
Below is the response:-
HTTP/1.1 200 OK
Date: Sat, 10 Nov 2018 07:08:45 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 71
Connection: keep-alive
Server: nginx/1.10.3 (Ubuntu)
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: date, authorization, x-powered-by, connection, server, access-control-allow-origin, content-type, content-length, x-final-url
authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiIyYmEyYjc1My03NWEwLTQxNGYtYWFiOC0zZGY1M2I4YmIwMDEiLCJpc0Nvb2siOnRydWUsImlhdCI6MTU0MTgzMzcyNX0.3FRVpHm4EF2Ahzzy-OjbZ2EeZto6-hSFKHNtG5wcjBs
Where I want to fetch the authorization.
I'm using Regular Expression Extractor, but it is throwing below error (URISyntaxException: illegal character in the path)
Snapshots:-
Step_1
Step_4
I have seen couple of queries related to this Error but not in Jmeter,
And i tried using % also, to get rid out of this error, but that didn't work out.
Thanks in advance.
Authorization is sent/receive in headers,
Change Step 2, Field to check should be Response Headers to get the value
I'm trying to implement an app with access to google drive in beast boost C++ usingoauth2 authentication.
https://developers.google.com/identity/protocols/OAuth2ForDevices
I try to get the user code in Postman with the following POST request:
POST /o/oauth2/device/code HTTP/1.1
Host: accounts.google.com
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdrive.file&client_id=610490019085-l1v2mv7lv95lu7cr111vbtqmp1bigv42.apps.googleusercontent.com
And it works perfectly fine, returning:
{
"verification_url": "https://www.google.com/device",
"expires_in": 1800,
"interval": 5,
"device_code": "AH-1Ng0IgBnIXIUeltwDoL7AwNExNTT0rozdxD5FMnP8dip4DaDi8_XtzK2aVT92YKYmYa7KWqHRVqw5AmJCDtalzK3k6pvbFw",
"user_code": "LWZY-BDXD"
}
Now I want to do the same request in C++ using boost, with the following code snippet for the request:
http::request<http::string_body> req{http::verb::post, "/o/oauth2/device/code", 11};
req.set(http::field::host, "accounts.google.com");
req.set("Cache-Control", "no-cache");
req.set(http::field::content_type, "application/x-www-form-urlencoded");
req.body() = "scope=https://www.googleapis.com/auth/drive.file&client_id=610490019085-l1v2mv7lv95lu7cr111vbtqmp1bigv42.apps.googleusercontent.com";
req.prepare_payload();
This one returns:
HTTP/1.0 307 Temporary Redirect
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Mon, 14 May 2018 11:06:01 GMT
Location: https://accounts.google.com/o/oauth2/device/code
Content-Length: 232
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
<HTML>
<HEAD>
<TITLE>Temporary Redirect</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>Temporary Redirect</H1>
The document has moved here.
</BODY>
</HTML>
Any ideas how I can get the JSON returned as with Postman?
Thank You!
Beast is a low-level protocol library, it doesn't know anything about resolving domain names or connecting sockets. It doesn't even know about TCP/IP, just how to serialize and deserialize HTTP/1 messages over objects which meet Asio's stream concept requirements (examples: SyncReadStream, or AsyncWriteStream). You have to handle redirects yourself. If you get a redirect response, extract the Location field value and parse the URI, resolve the domain, and then issue another GET request for the specified resource.
It is my hope that other folks (maybe you?) will build on top of beast and provide higher-level functionality like this in the form of open source libraries.
Currently I'm facing an issue in capturing the Cookies which is coming as part of response. I'm using WinInet for my connection.
After sending the request using HttpSendRequest, I'm using HttpQueryInfo to query the response in the below order
HTTP_QUERY_STATUS_CODE
HTTP_QUERY_SET_COOKIE
HTTP_QUERY_CONTENT_TYPE
HTTP_QUERY_CONTENT_LENGTH
Finally I'm reading body content using InternetReadFile.
Server has the loadbalance installed. all the response sent from LB has "Set-Cookies" enabled.
If I get any response without "Set-Cookies" in header then my code is reading the content successfully.
When there is "Set-Cookies" field in header then the issue comes. It is resulting out in "Header Not Found" when I query for "HTTP_QUERY_CONTENT_TYPE"
Below is the sample response header which is success
HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 17 Dec 2015 10:05:00 GMT
Content-Length: 107
Content-Type: text/html; Charset=utf-8
Via: 1.1 TestServer:80 (Cisco-WSA/8.8.0-085)
Connection: keep-alive
Below is the sample response header which is error out.
HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
Set-Cookie: MYID=B3C5D2B2%2D0426%2D473F%2DACF6%2DF19BAC3F5A6C%3A%3A88757401; path=/
X-Powered-By: ASP.NET
Date: Thu, 17 Dec 2015 10:07:20 GMT
Content-Length: 277
Content-Type: text/html; Charset=utf-8
Via: 1.1 TestServer:80 (Cisco-WSA/8.8.0-085)
Connection: keep-alive
Work around found,
While querying the response header, if I add HTTP_QUERY_COOKIE in the sequence then the issue is getting resolved but I'm not sure on this is correct or not.
Can any one help me?
Why SET_COOKIE is not able to catch the "set-cookies"
What is the difference between HTTP_QUERY_SET_COOKIE and HTTP_QUERY_COOKIE?
What will be the impact if I use HTTP_QUERY_COOKIE to overcome this issue?
Thanks
Vijay
I am using LibCurl/C++ to send and receive html requests. One of the servers I access returns back this header information Access-Control-Expose-Headers: X-Custom1, where X-Custom1 is a custom header to provide data that I need to parse. But I am not seeing any value for X-Custom1.
I tried requesting it specifically by adding
Access-Control-Request-Headers: X-Custom1
header in my curl c++ request. But no use.
Response header data:
HTTP/1.1 200
Server: <server name>
Date: Thu, 01 Oct 2015 06:43:06 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: <cookie data>; expires=Fri, 30-Sep-16 06:43:05 GMT; path=/; domain=<domain name>; HttpOnly
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Authorization,Content-Type,Accept,Origin,User-Agent
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Custom1
Access-Control-Max-Age: 1728000
Etag: W/"<tag data>"
CF-RAY: <ray data>
Content-Encoding: gzip
Anyone know how to get the X-Custom1 data ?
I have been stuck at this for a long time now and need help.
Forgive me if this could be a cross post or wrongly tagged. I am not sure where else to post this question.
Thanks in advance.
Looks like I have been asking the wrong question after all.The response merely says X-Custom1 will be accessible from the server. It turned out that I had to request an entirely different url to get the actual valid data for that header.
Posting it here to let others seeking out similar questions know how it turned out.
I am trying to create raw sockets in C/C++, then create a request message and then send that message to a target server. If the port I specify happens to be 80 I want to send a HTTP request to determine the HTTP version that the target server is using. For e.g I send GET HTTP/1.0 to www.google.com.
For some servers it returns HTTP/1.1 400 bad request. While in some cases it responds with an XML message. I know the GET command is wrong since I am not specifying any object to actually GET. So is there a generic way to do this?
Try:
HEAD / HTTP/1.0\r\n
\r\n
Or:
GET / HTTP/1.0\r\n
\r\n
The first line of the servers response should contain the HTTP version. Note that some servers will return 400 Bad Request if the Host: <hostname> is omitted from the header (which is not required in 1.0, but in 1.1). I would do:
Try:
HEAD / HTTP/1.0\r\n
Host: <hostname>\r\n
\r\n
Or:
GET / HTTP/1.0\r\n
Host: <hostname>\r\n
\r\n
If you don't require the message body, you should use HEAD as it will require less data to receive.
You will have to progressively try each version of HTTP. For example, if I query google.com with HTTP 1.0, it will respond with HTTP 1.0:
$ printf "HEAD / HTTP/1.0\nHost: google.com\n\n" | nc google.com 80
HTTP/1.0 301 Moved Permanently
Location: http://www.google.com/
Content-Type: text/html; charset=UTF-8
Date: Tue, 26 Nov 2013 19:44:42 GMT
Expires: Thu, 26 Dec 2013 19:44:42 GMT
Cache-Control: public, max-age=2592000
Server: gws
Content-Length: 219
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic
If I query it with HTTP 1.1, it will respond with HTTP 1.1:
$ printf "HEAD / HTTP/1.1\nHost: google.com\n\n" | nc google.com 80
HTTP/1.1 301 Moved Permanently
Location: http://www.google.com/
Content-Type: text/html; charset=UTF-8
Date: Tue, 26 Nov 2013 19:44:47 GMT
Expires: Thu, 26 Dec 2013 19:44:47 GMT
Cache-Control: public, max-age=2592000
Server: gws
Content-Length: 219
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic
GET / HTTP/1.0\r\n
Host: www.google.com\r\n
\r\n
This is a basic HTTP request. Alternatively, you can use HEAD instead of GET, sinse you only want the headers, but some basic servers don't recognize HEAD as a valid method.
Not every server will support HTTP/1.0, they will most likely ignore this and answer as HTTP/1.1, others will just ape the version in your request and not really mean it.
It can be frustrating to try to determine the HTTP version in a random server. Perhaps you should instead use 1.1 in the request and see if the server answers with 1.0, I believe it may be the safest way to know if the server is at least giving a damn.