The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

INTERCEPTING RESPONSES

When you are attempting to intercept and modify server responses, you may

find that the relevant message displayed in your proxy looks like this:

HTTP/1.1 304 Not Modified

Date: Wed, 21 Feb 2007 22:40:20 GMT

Etag: “6c7-5fcc0900”

Expires: Thu, 22 Feb 2007 00:40:20 GMT

Cache-Control: max-age=7200

This response arises because the browser already possesses a cached copy

of the resource it requested. When the browser requests a cached resource, it

typically adds two additional headers to the request, called 

If-Modified-

Since

and 

If-None-Match

:

GET /scripts/validate.js HTTP/1.1

Host: wahh-app.com

If-Modified-Since: Sat, 17 Feb 2007 19:48:20 GMT

If-None-Match: “6c7-5fcc0900”

These headers tell the server the time at which the browser last updated its