main
project
JavaSource
WebContent
META-INF
WEB-INF
css
database
images
javascript
lesson_plans
lesson_solutions
AccessControlMatrix_files
BackDoors_files
BasicAuthentication_files
BlindSqlInjection_files
CSRF_files
ClientSideFiltering_files
ClientSideValidation_files
CommandInjection_files
ConcurrencyCart_files
DOMInjection_files
DOMXSS_files
DOS_Login_files
FailOpenAuthentication_files
ForcedBrowsing_files
ForgotPassword_files
HiddenFieldTampering_files
HtmlClues_files
HttpBasics_files
HttpOnly_files
HttpSplitting_files
InsecureLogin_files
JSONInjection_files
JavaScriptValidation_files
Lab Access Control
Lab SQL Injection
Lab XSS
LogSpoofing_files
MultiLevelLogin1_files
MultiLevelLogin2_files
PasswordStrength_files
PathBasedAccessControl_files
ReflectedXSS_files
RemoteAdminFlaw_files
SessionFixation_files
SilentTransactions_files
SoapRequest_files
SqlNumericInjection_files
SqlStringInjection_files
StoredXSS_files
ThreadSafetyProblem_files
TraceXSS_files
UncheckedEmail_files
WSDLScanning_files
WeakAuthenticationCookie_files
WeakSessionID_files
WsSAXInjection_files
WsSqlInjection_files
XMLInjection_files
XPATHInjection_files
AccessControlMatrix.html
BackDoors.html
BasicAuthentication.html
BlindSqlInjection.html
CSRF.html
ClientSideFiltering.html
ClientSideValidation.html
CommandInjection.html
ConcurrencyCart.html
DOMInjection.html
DOMXSS.html
DOS_Login.html
DangerousEval.html
Encoding.html
FailOpenAuthentication.html
ForcedBrowsing.html
ForgotPassword.html
HiddenFieldTampering.html
HtmlClues.html
HttpBasics.html
HttpOnly.html
HttpSplitting.html
InsecureLogin.html
JSONInjection.html
JavaScriptValidation.html
LogSpoofing.html
MultiLevelLogin1.html
MultiLevelLogin2.html
PasswordStrength.html
PathBasedAccessControl.html
Phishing.html
ReflectedXSS.html
RemoteAdminFlaw.html
SessionFixation.html
SilentTransactions.html
SoapRequest.html
SqlNumericInjection.html
SqlStringInjection.html
StoredXss.html
ThreadSafetyProblem.html
TraceXSS.html
UncheckedEmail.html
WSDLScanning.html
WeakAuthenticationCookie.html
WeakSessionID.html
WsSAXInjection.html
WsSqlInjection.html
XMLInjection.html
XPATHInjection.html
formate.css
lessons
users
main.jsp
sideWindow.jsp
webgoat.jsp
webgoat_challenge.jsp
config
doc
build.xml
Eclipse-Workspace.zip
HOW TO create the WebGoat workspace.txt
build.xml
eclipse.bat
readme.txt
webgoat for SQL Server.bat
webgoat.bat
webgoat.sh
webgoat_8080.bat
webscarab.bat
7998e60f29
git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@367 4033779f-a91e-0410-96ef-6bf7bf53c507
1019 lines
48 KiB
HTML
1019 lines
48 KiB
HTML
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||
xmlns="http://www.w3.org/TR/REC-html40">
|
||
|
||
<head>
|
||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||
<meta name=ProgId content=Word.Document>
|
||
<meta name=Generator content="Microsoft Word 12">
|
||
<meta name=Originator content="Microsoft Word 12">
|
||
<link rel=File-List href="lesson_solutions/HttpSplitting_files/filelist.xml">
|
||
<link rel=Edit-Time-Data href="lesson_solutions/HttpSplitting_files/editdata.mso">
|
||
<!--[if !mso]>
|
||
<style>
|
||
v\:* {behavior:url(#default#VML);}
|
||
o\:* {behavior:url(#default#VML);}
|
||
w\:* {behavior:url(#default#VML);}
|
||
.shape {behavior:url(#default#VML);}
|
||
</style>
|
||
<![endif]--><!--[if gte mso 9]><xml>
|
||
<o:DocumentProperties>
|
||
<o:Author>egeirnaert</o:Author>
|
||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||
<o:Revision>3</o:Revision>
|
||
<o:TotalTime>1207</o:TotalTime>
|
||
<o:Created>2007-07-12T15:18:00Z</o:Created>
|
||
<o:LastSaved>2007-07-12T15:18:00Z</o:LastSaved>
|
||
<o:Pages>5</o:Pages>
|
||
<o:Words>557</o:Words>
|
||
<o:Characters>3178</o:Characters>
|
||
<o:Company> </o:Company>
|
||
<o:Lines>26</o:Lines>
|
||
<o:Paragraphs>7</o:Paragraphs>
|
||
<o:CharactersWithSpaces>3728</o:CharactersWithSpaces>
|
||
<o:Version>12.00</o:Version>
|
||
</o:DocumentProperties>
|
||
</xml><![endif]-->
|
||
<link rel=themeData href="lesson_solutions/HttpSplitting_files/themedata.thmx">
|
||
<link rel=colorSchemeMapping href="lesson_solutions/HttpSplitting_files/colorschememapping.xml">
|
||
<!--[if gte mso 9]><xml>
|
||
<w:WordDocument>
|
||
<w:Zoom>90</w:Zoom>
|
||
<w:TrackMoves>false</w:TrackMoves>
|
||
<w:TrackFormatting/>
|
||
<w:PunctuationKerning/>
|
||
<w:ValidateAgainstSchemas/>
|
||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||
<w:DoNotPromoteQF/>
|
||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||
<w:Compatibility>
|
||
<w:BreakWrappedTables/>
|
||
<w:SnapToGridInCell/>
|
||
<w:WrapTextWithPunct/>
|
||
<w:UseAsianBreakRules/>
|
||
<w:DontGrowAutofit/>
|
||
<w:SplitPgBreakAndParaMark/>
|
||
<w:DontVertAlignCellWithSp/>
|
||
<w:DontBreakConstrainedForcedTables/>
|
||
<w:DontVertAlignInTxbx/>
|
||
<w:Word11KerningPairs/>
|
||
<w:CachedColBalance/>
|
||
</w:Compatibility>
|
||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||
<m:mathPr>
|
||
<m:mathFont m:val="Cambria Math"/>
|
||
<m:brkBin m:val="before"/>
|
||
<m:brkBinSub m:val="--"/>
|
||
<m:smallFrac m:val="off"/>
|
||
<m:dispDef/>
|
||
<m:lMargin m:val="0"/>
|
||
<m:rMargin m:val="0"/>
|
||
<m:defJc m:val="centerGroup"/>
|
||
<m:wrapIndent m:val="1440"/>
|
||
<m:intLim m:val="subSup"/>
|
||
<m:naryLim m:val="undOvr"/>
|
||
</m:mathPr></w:WordDocument>
|
||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||
LatentStyleCount="267">
|
||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="heading 3"/>
|
||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light List"/>
|
||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Dark List"/>
|
||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||
</w:LatentStyles>
|
||
</xml><![endif]-->
|
||
<style>
|
||
<!--
|
||
/* Font Definitions */
|
||
@font-face
|
||
{font-family:Wingdings;
|
||
panose-1:5 0 0 0 0 0 0 0 0 0;
|
||
mso-font-charset:2;
|
||
mso-generic-font-family:auto;
|
||
mso-font-pitch:variable;
|
||
mso-font-signature:0 268435456 0 0 -2147483648 0;}
|
||
@font-face
|
||
{font-family:"MS Mincho";
|
||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||
mso-font-charset:128;
|
||
mso-generic-font-family:modern;
|
||
mso-font-pitch:fixed;
|
||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||
@font-face
|
||
{font-family:"Cambria Math";
|
||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||
mso-font-charset:0;
|
||
mso-generic-font-family:roman;
|
||
mso-font-pitch:variable;
|
||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||
@font-face
|
||
{font-family:Tahoma;
|
||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||
mso-font-charset:0;
|
||
mso-generic-font-family:swiss;
|
||
mso-font-pitch:variable;
|
||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||
@font-face
|
||
{font-family:"\@MS Mincho";
|
||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||
mso-font-charset:128;
|
||
mso-generic-font-family:modern;
|
||
mso-font-pitch:fixed;
|
||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||
/* Style Definitions */
|
||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||
{mso-style-unhide:no;
|
||
mso-style-qformat:yes;
|
||
mso-style-parent:"";
|
||
margin:0cm;
|
||
margin-bottom:.0001pt;
|
||
mso-pagination:widow-orphan;
|
||
font-size:12.0pt;
|
||
font-family:"Times New Roman","serif";
|
||
mso-fareast-font-family:"Times New Roman";}
|
||
h1
|
||
{mso-style-unhide:no;
|
||
mso-style-qformat:yes;
|
||
mso-style-link:"Heading 1 Char";
|
||
mso-style-next:Normal;
|
||
margin-top:12.0pt;
|
||
margin-right:0cm;
|
||
margin-bottom:3.0pt;
|
||
margin-left:0cm;
|
||
mso-pagination:widow-orphan;
|
||
page-break-after:avoid;
|
||
mso-outline-level:1;
|
||
font-size:16.0pt;
|
||
font-family:"Arial","sans-serif";
|
||
mso-fareast-font-family:"MS Mincho";
|
||
mso-font-kerning:16.0pt;
|
||
mso-fareast-language:JA;
|
||
font-weight:bold;}
|
||
h2
|
||
{mso-style-priority:9;
|
||
mso-style-qformat:yes;
|
||
mso-style-link:"Heading 2 Char";
|
||
mso-style-next:Normal;
|
||
margin-top:10.0pt;
|
||
margin-right:0cm;
|
||
margin-bottom:0cm;
|
||
margin-left:0cm;
|
||
margin-bottom:.0001pt;
|
||
mso-pagination:widow-orphan lines-together;
|
||
page-break-after:avoid;
|
||
mso-outline-level:2;
|
||
font-size:13.0pt;
|
||
font-family:"Cambria","serif";
|
||
mso-ascii-font-family:Cambria;
|
||
mso-ascii-theme-font:major-latin;
|
||
mso-fareast-font-family:"Times New Roman";
|
||
mso-fareast-theme-font:major-fareast;
|
||
mso-hansi-font-family:Cambria;
|
||
mso-hansi-theme-font:major-latin;
|
||
mso-bidi-font-family:"Times New Roman";
|
||
mso-bidi-theme-font:major-bidi;
|
||
color:#4F81BD;
|
||
mso-themecolor:accent1;
|
||
font-weight:bold;}
|
||
h3
|
||
{mso-style-unhide:no;
|
||
mso-style-qformat:yes;
|
||
mso-style-link:"Heading 3 Char";
|
||
mso-style-next:Normal;
|
||
margin-top:12.0pt;
|
||
margin-right:0cm;
|
||
margin-bottom:3.0pt;
|
||
margin-left:0cm;
|
||
mso-pagination:widow-orphan;
|
||
page-break-after:avoid;
|
||
mso-outline-level:3;
|
||
font-size:13.0pt;
|
||
font-family:"Arial","sans-serif";
|
||
mso-fareast-font-family:"Times New Roman";
|
||
font-weight:bold;}
|
||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||
{mso-style-qformat:yes;
|
||
mso-style-next:Normal;
|
||
margin:0cm;
|
||
margin-bottom:.0001pt;
|
||
mso-pagination:widow-orphan;
|
||
font-size:10.0pt;
|
||
font-family:"Times New Roman","serif";
|
||
mso-fareast-font-family:"Times New Roman";
|
||
font-weight:bold;}
|
||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||
{mso-style-noshow:yes;
|
||
mso-style-priority:99;
|
||
margin:0cm;
|
||
margin-bottom:.0001pt;
|
||
mso-pagination:widow-orphan;
|
||
font-size:12.0pt;
|
||
font-family:"Times New Roman","serif";
|
||
mso-fareast-font-family:"Times New Roman";
|
||
mso-fareast-theme-font:major-fareast;}
|
||
a:link, span.MsoHyperlink
|
||
{mso-style-noshow:yes;
|
||
color:blue;
|
||
text-decoration:underline;
|
||
text-underline:single;}
|
||
a:visited, span.MsoHyperlinkFollowed
|
||
{mso-style-noshow:yes;
|
||
mso-style-priority:99;
|
||
color:purple;
|
||
mso-themecolor:followedhyperlink;
|
||
text-decoration:underline;
|
||
text-underline:single;}
|
||
p
|
||
{mso-style-noshow:yes;
|
||
mso-margin-top-alt:auto;
|
||
margin-right:0cm;
|
||
mso-margin-bottom-alt:auto;
|
||
margin-left:0cm;
|
||
mso-pagination:widow-orphan;
|
||
font-size:12.0pt;
|
||
font-family:"Times New Roman","serif";
|
||
mso-fareast-font-family:"Times New Roman";}
|
||
pre
|
||
{mso-style-priority:99;
|
||
mso-style-unhide:no;
|
||
mso-style-link:"HTML Preformatted Char";
|
||
margin:0cm;
|
||
margin-bottom:.0001pt;
|
||
mso-pagination:widow-orphan;
|
||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||
font-size:10.0pt;
|
||
font-family:"Courier New";
|
||
mso-fareast-font-family:"Times New Roman";}
|
||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||
{mso-style-noshow:yes;
|
||
mso-style-priority:99;
|
||
mso-style-link:"Balloon Text Char";
|
||
margin:0cm;
|
||
margin-bottom:.0001pt;
|
||
mso-pagination:widow-orphan;
|
||
font-size:8.0pt;
|
||
font-family:"Tahoma","sans-serif";
|
||
mso-fareast-font-family:"Times New Roman";}
|
||
span.Heading1Char
|
||
{mso-style-name:"Heading 1 Char";
|
||
mso-style-unhide:no;
|
||
mso-style-locked:yes;
|
||
mso-style-link:"Heading 1";
|
||
mso-ansi-font-size:16.0pt;
|
||
mso-bidi-font-size:16.0pt;
|
||
font-family:"MS Mincho";
|
||
mso-ascii-font-family:"MS Mincho";
|
||
mso-fareast-font-family:"MS Mincho";
|
||
mso-hansi-font-family:"MS Mincho";
|
||
mso-bidi-font-family:Arial;
|
||
mso-font-kerning:16.0pt;
|
||
mso-fareast-language:JA;
|
||
font-weight:bold;}
|
||
span.Heading2Char
|
||
{mso-style-name:"Heading 2 Char";
|
||
mso-style-priority:9;
|
||
mso-style-unhide:no;
|
||
mso-style-locked:yes;
|
||
mso-style-link:"Heading 2";
|
||
mso-ansi-font-size:13.0pt;
|
||
mso-bidi-font-size:13.0pt;
|
||
font-family:"Cambria","serif";
|
||
mso-ascii-font-family:Cambria;
|
||
mso-ascii-theme-font:major-latin;
|
||
mso-fareast-font-family:"Times New Roman";
|
||
mso-fareast-theme-font:major-fareast;
|
||
mso-hansi-font-family:Cambria;
|
||
mso-hansi-theme-font:major-latin;
|
||
color:#4F81BD;
|
||
mso-themecolor:accent1;
|
||
font-weight:bold;}
|
||
span.BalloonTextChar
|
||
{mso-style-name:"Balloon Text Char";
|
||
mso-style-noshow:yes;
|
||
mso-style-priority:99;
|
||
mso-style-unhide:no;
|
||
mso-style-locked:yes;
|
||
mso-style-link:"Balloon Text";
|
||
mso-ansi-font-size:8.0pt;
|
||
mso-bidi-font-size:8.0pt;
|
||
font-family:"Tahoma","sans-serif";
|
||
mso-ascii-font-family:Tahoma;
|
||
mso-fareast-font-family:"Times New Roman";
|
||
mso-hansi-font-family:Tahoma;
|
||
mso-bidi-font-family:Tahoma;}
|
||
span.HTMLPreformattedChar
|
||
{mso-style-name:"HTML Preformatted Char";
|
||
mso-style-priority:99;
|
||
mso-style-unhide:no;
|
||
mso-style-locked:yes;
|
||
mso-style-link:"HTML Preformatted";
|
||
font-family:"Courier New";
|
||
mso-ascii-font-family:"Courier New";
|
||
mso-fareast-font-family:"Times New Roman";
|
||
mso-hansi-font-family:"Courier New";
|
||
mso-bidi-font-family:"Courier New";}
|
||
span.Heading3Char
|
||
{mso-style-name:"Heading 3 Char";
|
||
mso-style-unhide:no;
|
||
mso-style-locked:yes;
|
||
mso-style-link:"Heading 3";
|
||
mso-ansi-font-size:13.0pt;
|
||
mso-bidi-font-size:13.0pt;
|
||
font-family:"Times New Roman","serif";
|
||
mso-fareast-font-family:"Times New Roman";
|
||
mso-bidi-font-family:Arial;
|
||
font-weight:bold;}
|
||
.MsoChpDefault
|
||
{mso-style-type:export-only;
|
||
mso-default-props:yes;
|
||
font-size:10.0pt;
|
||
mso-ansi-font-size:10.0pt;
|
||
mso-bidi-font-size:10.0pt;
|
||
mso-ascii-font-family:Arial;
|
||
mso-fareast-font-family:Calibri;
|
||
mso-fareast-theme-font:minor-latin;
|
||
mso-hansi-font-family:Arial;
|
||
mso-bidi-font-family:"Times New Roman";
|
||
mso-bidi-theme-font:major-bidi;}
|
||
@page Section1
|
||
{size:595.3pt 841.9pt;
|
||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||
mso-header-margin:35.3pt;
|
||
mso-footer-margin:35.3pt;
|
||
mso-title-page:yes;
|
||
mso-paper-source:0;}
|
||
div.Section1
|
||
{page:Section1;}
|
||
/* List Definitions */
|
||
@list l0
|
||
{mso-list-id:74865116;
|
||
mso-list-type:hybrid;
|
||
mso-list-template-ids:197531764 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
|
||
@list l0:level1
|
||
{mso-level-tab-stop:36.0pt;
|
||
mso-level-number-position:left;
|
||
text-indent:-18.0pt;}
|
||
ol
|
||
{margin-bottom:0cm;}
|
||
ul
|
||
{margin-bottom:0cm;}
|
||
-->
|
||
</style>
|
||
<!--[if gte mso 10]>
|
||
<style>
|
||
/* Style Definitions */
|
||
table.MsoNormalTable
|
||
{mso-style-name:"Table Normal";
|
||
mso-tstyle-rowband-size:0;
|
||
mso-tstyle-colband-size:0;
|
||
mso-style-noshow:yes;
|
||
mso-style-priority:99;
|
||
mso-style-qformat:yes;
|
||
mso-style-parent:"";
|
||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||
mso-para-margin:0cm;
|
||
mso-para-margin-bottom:.0001pt;
|
||
mso-pagination:widow-orphan;
|
||
font-size:10.0pt;
|
||
font-family:"Arial","sans-serif";
|
||
mso-bidi-font-family:"Times New Roman";
|
||
mso-bidi-theme-font:major-bidi;}
|
||
</style>
|
||
<![endif]--><!--[if gte mso 9]><xml>
|
||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||
<o:shapelayout v:ext="edit">
|
||
<o:idmap v:ext="edit" data="1"/>
|
||
</o:shapelayout></xml><![endif]-->
|
||
</head>
|
||
|
||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||
|
||
<div class=Section1>
|
||
|
||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||
Perform Http Splitting <o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||
|
||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This lesson
|
||
teaches how to perform HTTP Splitting attacks. <o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||
|
||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>How the
|
||
attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The attacker
|
||
passes malicious code to the web server together with normal input. A victim
|
||
application will not be checking for CR (carriage return, also given by %0d or
|
||
\r) and LF (line feed, also given by %0a or \n)characters. These characters not
|
||
only give attackers control of the remaining headers and body of the response
|
||
the application intends to send, but also allows them to create additional
|
||
responses entirely under their control.<br>
|
||
The effect of an HTTP Splitting attack is maximized when accompanied with a
|
||
Cache Poisoning. The goal of Cache Poisoning attack is to poison the cache of
|
||
the victim by fooling the cache to believe that the page hijacked using the
|
||
HTTP splitting is a good one and it is indeed the server's copy.<br>
|
||
The attack happens using the HTTP Splitting attack plus adding the <b>Last-Modified:</b>
|
||
header and setting it to a future date. This will force the browser to send <b>If-Modified-Since</b>
|
||
request header, which gives the attacker the chance to intercept the server's
|
||
reply and replace it with a '304 Not Modified' reply. A sample of a 304 response
|
||
is:<br>
|
||
HTTP/1.1 304 Not Modified <br>
|
||
Date: Fri, 30 Dec 2005 17:32:47 GMT <o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||
|
||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||
|
||
<!-- Start Instructions -->
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>
|
||
This lesson has two stages. Stage 1 teaches you how to do HTTP Splitting attacks while
|
||
stage 2 builds on that to teach you how to elevate HTTP Splitting to Cache Poisoning.<br>
|
||
Enter a language for the system to search by. You will notice that the
|
||
application is redirecting your request to another resource on the server. You
|
||
should be able to use the CR (%0d) and LF (%0a) to exploit the attack. Your
|
||
exercise should be to force the server to send a 200 OK. If the screen changed
|
||
as an effect to your attack, just go back to the homepage and after stage 2 is
|
||
exploited successfully you will find the green check in the left menu.<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal><span style='mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype
|
||
id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t"
|
||
path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
|
||
<v:stroke joinstyle="miter"/>
|
||
<v:formulas>
|
||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||
<v:f eqn="sum @0 1 0"/>
|
||
<v:f eqn="sum 0 0 @1"/>
|
||
<v:f eqn="prod @2 1 2"/>
|
||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||
<v:f eqn="sum @0 0 1"/>
|
||
<v:f eqn="prod @6 1 2"/>
|
||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||
<v:f eqn="sum @8 21600 0"/>
|
||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||
<v:f eqn="sum @10 21600 0"/>
|
||
</v:formulas>
|
||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||
<o:lock v:ext="edit" aspectratio="t"/>
|
||
</v:shapetype><v:shape id="Picture_x0020_159" o:spid="_x0000_i1038" type="#_x0000_t75"
|
||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image001.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||
src="lesson_solutions/HttpSplitting_files/image029.jpg" v:shapes="Picture_x0020_159"><![endif]></span></p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||
style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>
|
||
Please note that this solution is written for Windows. If you use Linux you have to alter it.
|
||
Windows uses a CR and LF for new Line. Linux uses only LF.
|
||
So all the %0d%0a have to be replaced by %0a if you are using Linux.<br/><br/>
|
||
<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Because the
|
||
input is not validated you can inject any HTTP syntax, carriage returns and
|
||
line-feed you want. <o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Enter a
|
||
language to examine what's going on. You do have WebScarab intercepting HTTP
|
||
requests and responses?<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_160"
|
||
o:spid="_x0000_i1037" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||
visibility:visible;mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image003.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||
src="lesson_solutions/HttpSplitting_files/image030.jpg" v:shapes="Picture_x0020_160"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> Language en</p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_161" o:spid="_x0000_i1036"
|
||
type="#_x0000_t75" style='width:481.5pt;height:344.25pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image005.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image031.jpg" v:shapes="Picture_x0020_161"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> HTTP Request</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_162" o:spid="_x0000_i1035"
|
||
type="#_x0000_t75" style='width:481.5pt;height:344.25pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image007.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image032.jpg" v:shapes="Picture_x0020_162"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> First HTTP Response</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_163" o:spid="_x0000_i1034"
|
||
type="#_x0000_t75" style='width:481.5pt;height:344.25pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image009.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image033.jpg" v:shapes="Picture_x0020_163"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> Second HTTP Request</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Now inject
|
||
for the language en%0d%0a%0d%0a%0d%0a<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_164"
|
||
o:spid="_x0000_i1033" type="#_x0000_t75" style='width:481.5pt;height:344.25pt;
|
||
visibility:visible;mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image011.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image034.jpg" v:shapes="Picture_x0020_164"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> First HTTP Request</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_165" o:spid="_x0000_i1032"
|
||
type="#_x0000_t75" style='width:481.5pt;height:344.25pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image013.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image035.jpg" v:shapes="Picture_x0020_165"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> First HTTP Response</p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The
|
||
Content-Length: 0 will tell the server that the first request is over.<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>A 200 OK
|
||
message looks like this: HTTP/1.1 200 OK<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Lets see what
|
||
you can do with: foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2047%0d%0a%0d%0a<html>Hacked
|
||
</span><span style='font-family:Wingdings;mso-ascii-font-family:Arial;
|
||
mso-hansi-font-family:Arial;mso-bidi-font-family:Arial;mso-char-type:symbol;
|
||
mso-symbol-font-family:Wingdings'><span style='mso-char-type:symbol;mso-symbol-font-family:
|
||
Wingdings'>J</span></span><span style='font-family:"Arial","sans-serif"'></html><o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_166"
|
||
o:spid="_x0000_i1031" type="#_x0000_t75" style='width:481.5pt;height:344.25pt;
|
||
visibility:visible;mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image015.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image036.jpg" v:shapes="Picture_x0020_166"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>7</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> HTTP Splitting attack</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_167" o:spid="_x0000_i1030"
|
||
type="#_x0000_t75" style='width:481.5pt;height:344.25pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image017.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image037.jpg" v:shapes="Picture_x0020_167"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>8</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> HTTP Response</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_168" o:spid="_x0000_i1029"
|
||
type="#_x0000_t75" style='width:481.5pt;height:344.25pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image019.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image038.jpg" v:shapes="Picture_x0020_168"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>9</span><!--[if supportFields]><span style='mso-element:
|
||
field-end'></span><![endif]--> Second HTTP Request</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_169" o:spid="_x0000_i1028"
|
||
type="#_x0000_t75" style='width:481.5pt;height:344.25pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image021.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||
src="lesson_solutions/HttpSplitting_files/image039.jpg" v:shapes="Picture_x0020_169"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>10</span><!--[if supportFields]><span
|
||
style='mso-element:field-end'></span><![endif]--> Second HTTP Response</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_170" o:spid="_x0000_i1027"
|
||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image023.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||
src="lesson_solutions/HttpSplitting_files/image040.jpg" v:shapes="Picture_x0020_170"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>11</span><!--[if supportFields]><span
|
||
style='mso-element:field-end'></span><![endif]--> Hacked!</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Hit the "Back"
|
||
button of your browser.<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_171"
|
||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||
visibility:visible;mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image025.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||
src="lesson_solutions/HttpSplitting_files/image041.jpg" v:shapes="Picture_x0020_171"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>12</span><!--[if supportFields]><span
|
||
style='mso-element:field-end'></span><![endif]--> Stage 1 completed</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Now you know
|
||
how to do HTTP Splitting. You can abuse this technique to do a cache poisoning
|
||
attack.<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Cache
|
||
poisoning requires manipulating the Last-Modified header. This must be changed
|
||
to a date in the future.<o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Inject: foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aLast-Modified:%20Mon,%2027%20Oct%202003%2014:50:18%20GMT%0d%0aContent-Length:%2047%0d%0a%0d%0a<html>Hacked
|
||
</span><span style='font-family:Wingdings;mso-ascii-font-family:Arial;
|
||
mso-hansi-font-family:Arial;mso-bidi-font-family:Arial;mso-char-type:symbol;
|
||
mso-symbol-font-family:Wingdings'><span style='mso-char-type:symbol;mso-symbol-font-family:
|
||
Wingdings'>J</span></span><span style='font-family:"Arial","sans-serif"'></html><o:p></o:p></span></p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_172" o:spid="_x0000_i1025"
|
||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||
mso-wrap-style:square'>
|
||
<v:imagedata src="lesson_solutions/HttpSplitting_files/image027.png" o:title=""/>
|
||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||
src="lesson_solutions/HttpSplitting_files/image042.jpg" v:shapes="Picture_x0020_172"><![endif]></span></p>
|
||
|
||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||
style='mso-no-proof:yes'>13</span><!--[if supportFields]><span
|
||
style='mso-element:field-end'></span><![endif]--> Inject cache poisoning</p>
|
||
|
||
<p class=MsoNormal><o:p> </o:p></p>
|
||
|
||
</div>
|
||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||
<tr>
|
||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||
Solution by Erwin Geirnaert
|
||
</td>
|
||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||
</tr>
|
||
</table>
|
||
|
||
</body>
|
||
|
||
</html>
|