Cover Your Tracks

Re:Cover Your Tracks by EE84M3i on Saturday November 21, 2020 @05:54AM (#25168976)

Is it actually possible to request most sites that way, without a host header? Maybe if it's tls and you already used sni, but I think most sites use a cdn that uses some form of virtual hosting to share ip addresses.

[ Parent | on HN ]

Re:Cover Your Tracks by 1vuio0pswjnm7 on Sunday November 22, 2020 @01:18AM (#25175397)

Consider the basic httpd feature of providing an automatically generated index to a directory. It is possible to locate content, including names of virtual hosts, with only an IP address.

[ Parent | on HN ]

Re:Cover Your Tracks by formerly_proven on Saturday November 21, 2020 @09:00AM (#25169755)

Sure.

    > nc news.ycombinator.com 80 
    GET / HTTP/1.0

    HTTP/1.1 301 Moved Permanently
    Server: nginx
    Date: Sat, 21 Nov 2020 13:59:31 GMT
    Content-Type: text/html
    Content-Length: 178
    Connection: close
    Location: https://news.ycombinator.com/

[ Parent | on HN ]

Re:Cover Your Tracks by sokoloff on Saturday November 21, 2020 @09:09AM (#25169812)

That is perhaps the least convincing test case you could have chosen to support your argument. (You basically proved you could fetch a content-less page, in part because that was the easiest proof case you could write, but because it didn’t demonstrate anything that an HN reader would come here for, it doesn’t resonate convincingly.)

[ Parent | on HN ]

Re:Cover Your Tracks by formerly_proven on Saturday November 21, 2020 @12:26PM (#25171063)

    > openssl s_client -connect news.ycombinator.com:443
    GET / HTTP/1.0

    HTTP/1.1 200 OK
    Server: nginx
    Date: Sat, 21 Nov 2020 17:25:28 GMT
    Content-Type: text/html; charset=utf-8
    Connection: close
    Vary: Accept-Encoding
    Cache-Control: private; max-age=0
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block
    Referrer-Policy: origin
    Strict-Transport-Security: max-age=31556900
    Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://cdnjs.cloudflare.com/; frame-src 'self' https://www.google.com/recaptcha/; style-src 'self' 'unsafe-inline'

    <html lang="en" op="news"><head><meta name="referrer" content="origin"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link rel="stylesheet" type="text/css" href="news.css?jacyibSTLtogl89kgrgw">
            <link rel="shortcut icon" href="favicon.ico">
              <link rel="alternate" type="application/rss+xml" title="RSS" href="rss">


            <title>Hacker News</title>

[ Parent | on HN ]