HTTP Headers For Fun & Profit

Re:HTTP Headers For Fun & Profit by citricsquid on Friday December 07, 2012 @05:30AM (#4886355)

curl -I www.reddit.com

    HTTP/1.1 200 OK
    Content-Type: text/html; charset=UTF-8
    Server: '; DROP TABLE servertypes; --
    Date: Fri, 07 Dec 2012 10:30:26 GMT
    Connection: keep-alive

[ Parent | on HN ]

Re:HTTP Headers For Fun & Profit by cpsales on Friday December 07, 2012 @07:02AM (#4886563)

Haha, brilliant!

[ Parent | on HN ]

Re:HTTP Headers For Fun & Profit by Selfcommit on Friday December 07, 2012 @10:14AM (#4887210)

I don't get it - What am I missing?

[ Parent | on HN ]

Re:HTTP Headers For Fun & Profit by citricsquid on Friday December 07, 2012 @10:29AM (#4887282)

    Server: '; DROP TABLE servertypes; --

It's a mysql injection. If someone was scraping headers and logging them and wasn't validating the input -- and their database was named "servertypes" -- it would delete the database.

[ Parent | on HN ]