SlideShare uma empresa Scribd logo
1 de 31
Baixar para ler offline
DIVIDE AND CONQUER
HTTP RESPONSE SPLITTING, WEB CACHE POISONING ATTACKS,
AND RELATED TOPICS
A whitepaper from Watchfire


By Amit Klein, Director of Security and Research, Sanctum, Inc.
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting
Http Response Splitting

Mais conteúdo relacionado

Mais procurados

Electric circuits notes
Electric circuits notesElectric circuits notes
Electric circuits notes
Ram B
 
Http Request Smuggling
Http Request SmugglingHttp Request Smuggling
Http Request Smuggling
guestc27cd9
 
The M&A project of GE and Alstom
The M&A project of GE and AlstomThe M&A project of GE and Alstom
The M&A project of GE and Alstom
Yan Meng
 
Rafal_Malanij_MSc_Dissertation
Rafal_Malanij_MSc_DissertationRafal_Malanij_MSc_Dissertation
Rafal_Malanij_MSc_Dissertation
Rafał Małanij
 
DB Security Oracle 11g-Application Context, Dynamic Views & Aduits
DB Security Oracle 11g-Application Context, Dynamic Views & AduitsDB Security Oracle 11g-Application Context, Dynamic Views & Aduits
DB Security Oracle 11g-Application Context, Dynamic Views & Aduits
Sunny U Okoro
 

Mais procurados (6)

Wireless notes
Wireless notesWireless notes
Wireless notes
 
Electric circuits notes
Electric circuits notesElectric circuits notes
Electric circuits notes
 
Http Request Smuggling
Http Request SmugglingHttp Request Smuggling
Http Request Smuggling
 
The M&A project of GE and Alstom
The M&A project of GE and AlstomThe M&A project of GE and Alstom
The M&A project of GE and Alstom
 
Rafal_Malanij_MSc_Dissertation
Rafal_Malanij_MSc_DissertationRafal_Malanij_MSc_Dissertation
Rafal_Malanij_MSc_Dissertation
 
DB Security Oracle 11g-Application Context, Dynamic Views & Aduits
DB Security Oracle 11g-Application Context, Dynamic Views & AduitsDB Security Oracle 11g-Application Context, Dynamic Views & Aduits
DB Security Oracle 11g-Application Context, Dynamic Views & Aduits
 

Semelhante a Http Response Splitting

Web App Security Automated Scanning
Web App Security Automated ScanningWeb App Security Automated Scanning
Web App Security Automated Scanning
Aung Khant
 
Web Risk Exposure Intranet
Web Risk Exposure IntranetWeb Risk Exposure Intranet
Web Risk Exposure Intranet
Aung Khant
 
Privilege Escalation
Privilege EscalationPrivilege Escalation
Privilege Escalation
Aung Khant
 
12mostappattacks
12mostappattacks12mostappattacks
12mostappattacks
Aung Khant
 
Anomaly_Analysis_of_OpenStack_Firewall_Polices_Report
Anomaly_Analysis_of_OpenStack_Firewall_Polices_ReportAnomaly_Analysis_of_OpenStack_Firewall_Polices_Report
Anomaly_Analysis_of_OpenStack_Firewall_Polices_Report
Ciaran McDonald
 
Firewall and proxy servers howto
Firewall and proxy servers howtoFirewall and proxy servers howto
Firewall and proxy servers howto
Kumar
 
Developingsecurewebappswatchfire
DevelopingsecurewebappswatchfireDevelopingsecurewebappswatchfire
Developingsecurewebappswatchfire
Aung Khant
 
Yahoo Web Analytics API Reference Guide
Yahoo Web Analytics API Reference GuideYahoo Web Analytics API Reference Guide
Yahoo Web Analytics API Reference Guide
Andrew Talcott
 
TECHNICAL BRIEF: Using Symantec Endpoint Protection 12.1 to Protect Against A...
TECHNICAL BRIEF: Using Symantec Endpoint Protection 12.1 to Protect Against A...TECHNICAL BRIEF: Using Symantec Endpoint Protection 12.1 to Protect Against A...
TECHNICAL BRIEF: Using Symantec Endpoint Protection 12.1 to Protect Against A...
Symantec
 
Wireshark user's guide
Wireshark user's guideWireshark user's guide
Wireshark user's guide
Gió Lào
 
Aplplication server instalacion
Aplplication server instalacionAplplication server instalacion
Aplplication server instalacion
hkaczuba
 

Semelhante a Http Response Splitting (20)

Web App Security Automated Scanning
Web App Security Automated ScanningWeb App Security Automated Scanning
Web App Security Automated Scanning
 
Web Risk Exposure Intranet
Web Risk Exposure IntranetWeb Risk Exposure Intranet
Web Risk Exposure Intranet
 
Privilege Escalation
Privilege EscalationPrivilege Escalation
Privilege Escalation
 
Kentico Cms Security White Paper
Kentico Cms Security White PaperKentico Cms Security White Paper
Kentico Cms Security White Paper
 
12mostappattacks
12mostappattacks12mostappattacks
12mostappattacks
 
Anomaly_Analysis_of_OpenStack_Firewall_Polices_Report
Anomaly_Analysis_of_OpenStack_Firewall_Polices_ReportAnomaly_Analysis_of_OpenStack_Firewall_Polices_Report
Anomaly_Analysis_of_OpenStack_Firewall_Polices_Report
 
Firewall and proxy servers howto
Firewall and proxy servers howtoFirewall and proxy servers howto
Firewall and proxy servers howto
 
Xss Explained
Xss ExplainedXss Explained
Xss Explained
 
SafeDNS Content Filtering Service Guide
SafeDNS Content Filtering Service GuideSafeDNS Content Filtering Service Guide
SafeDNS Content Filtering Service Guide
 
Developingsecurewebappswatchfire
DevelopingsecurewebappswatchfireDevelopingsecurewebappswatchfire
Developingsecurewebappswatchfire
 
Yahoo Web Analytics API Reference Guide
Yahoo Web Analytics API Reference GuideYahoo Web Analytics API Reference Guide
Yahoo Web Analytics API Reference Guide
 
TECHNICAL BRIEF: Using Symantec Endpoint Protection 12.1 to Protect Against A...
TECHNICAL BRIEF: Using Symantec Endpoint Protection 12.1 to Protect Against A...TECHNICAL BRIEF: Using Symantec Endpoint Protection 12.1 to Protect Against A...
TECHNICAL BRIEF: Using Symantec Endpoint Protection 12.1 to Protect Against A...
 
actix lte
actix lteactix lte
actix lte
 
Sybase Adaptive Server Anywhere for Linux
Sybase Adaptive Server Anywhere for LinuxSybase Adaptive Server Anywhere for Linux
Sybase Adaptive Server Anywhere for Linux
 
Cisco Virtualization Experience Infrastructure
Cisco Virtualization Experience InfrastructureCisco Virtualization Experience Infrastructure
Cisco Virtualization Experience Infrastructure
 
Wireshark user's guide
Wireshark user's guideWireshark user's guide
Wireshark user's guide
 
Httpclient tutorial
Httpclient tutorialHttpclient tutorial
Httpclient tutorial
 
spring-security-reference.pdf
spring-security-reference.pdfspring-security-reference.pdf
spring-security-reference.pdf
 
Aplplication server instalacion
Aplplication server instalacionAplplication server instalacion
Aplplication server instalacion
 
O reilly cisco ios access lists
O reilly   cisco ios access listsO reilly   cisco ios access lists
O reilly cisco ios access lists
 

Mais de guestc27cd9

Improving Web App Sec Microsoft
Improving Web App Sec MicrosoftImproving Web App Sec Microsoft
Improving Web App Sec Microsoft
guestc27cd9
 
Iis Security Programming Countermeasures
Iis Security Programming CountermeasuresIis Security Programming Countermeasures
Iis Security Programming Countermeasures
guestc27cd9
 
Financial Website Security
Financial Website SecurityFinancial Website Security
Financial Website Security
guestc27cd9
 
Future Inet Worms
Future Inet WormsFuture Inet Worms
Future Inet Worms
guestc27cd9
 
Guide2 Web App Sec
Guide2 Web App SecGuide2 Web App Sec
Guide2 Web App Sec
guestc27cd9
 
I Http Module Leveraging
I Http Module LeveragingI Http Module Leveraging
I Http Module Leveraging
guestc27cd9
 
Exploiting And Defending Web Applications
Exploiting And Defending Web ApplicationsExploiting And Defending Web Applications
Exploiting And Defending Web Applications
guestc27cd9
 

Mais de guestc27cd9 (10)

Improving Web App Sec Microsoft
Improving Web App Sec MicrosoftImproving Web App Sec Microsoft
Improving Web App Sec Microsoft
 
Iis Security Programming Countermeasures
Iis Security Programming CountermeasuresIis Security Programming Countermeasures
Iis Security Programming Countermeasures
 
Financial Website Security
Financial Website SecurityFinancial Website Security
Financial Website Security
 
Form Tampering
Form TamperingForm Tampering
Form Tampering
 
Future Inet Worms
Future Inet WormsFuture Inet Worms
Future Inet Worms
 
Guide2 Web App Sec
Guide2 Web App SecGuide2 Web App Sec
Guide2 Web App Sec
 
Hacking Tomcat
Hacking TomcatHacking Tomcat
Hacking Tomcat
 
I Http Module Leveraging
I Http Module LeveragingI Http Module Leveraging
I Http Module Leveraging
 
Exploiting And Defending Web Applications
Exploiting And Defending Web ApplicationsExploiting And Defending Web Applications
Exploiting And Defending Web Applications
 
Evolution Xss
Evolution XssEvolution Xss
Evolution Xss
 

Último

EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
Earley Information Science
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Último (20)

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slides
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 

Http Response Splitting

  • 1. DIVIDE AND CONQUER HTTP RESPONSE SPLITTING, WEB CACHE POISONING ATTACKS, AND RELATED TOPICS A whitepaper from Watchfire By Amit Klein, Director of Security and Research, Sanctum, Inc.