Anatomy of an Attack: How I Hacked StackOverflow (2012)

Re:Anatomy of an Attack: How I Hacked StackOverflow (2012) by MichaelGG on Sunday July 26, 2015 @05:20PM (#9952232)

Inband signalling is such a terrible idea and is so hard to get right. Here's the next step: try screwing up how you write headers. Use line wrapping and comments[1], or mix up crlf with just cr or lf. Very possible you'll make one proxy ignore your malicious header, but have the next HTTP software take it. This type of attack can be called "confused deputy".

This same issue exists on many VoIP networks as they share the same broken parsing ideas (in SIP).

1: HTTP allows you to line wrap headers and add comments. It's stupidly bizarre. It comes from the 70s or 60s where you wouldn't have a client program, so human-formatted headers weren't just a debug benefit, but a necessary requirement. The IETF can be rather clueless, so they blindly copy these terrible ideas into new protocols, like HTTP and SIP.

[ Parent | on HN ]

Re:Anatomy of an Attack: How I Hacked StackOverflow (2012) by jcranmer on Sunday July 26, 2015 @11:11PM (#9953138)

Actually, most header fields don't allow comments. The most common one that does (User-Agent) isn't exactly necessary for processing, and is its own little world of bizarre pain.

There's a lot of historical header abuse caused by the fact that HTTP sort of shared a syntax with email MIME headers, but HTTP implementations have generally started treating such abuses as malformed. (MIME on the other hand still hasn't. It's actually quite gory.)

[ Parent | on HN ]

Re:Anatomy of an Attack: How I Hacked StackOverflow (2012) by ChuckMcM on Sunday July 26, 2015 @09:21PM (#9952901)

like having your web services stop if the end of your url is some magic string. Inband signalling is impossible to get right in my opinion.

[ Parent | on HN ]