The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Exploiting Header Injection Vulnerabilities

Potential header injection vulnerabilities can be detected in a similar way to

XSS vulnerabilities, since you are looking for cases where user-controllable

input reappears anywhere within the HTTP headers returned by the applica-

tion. Hence, in the course of probing the application for XSS vulnerabilities,

434

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 434

---

you should also identify any locations where the application may be vulnera-

ble to header injection.

HACK STEPS

■