Skip to content
All your header are belong to us
portswigger.net | blog | #php | #web-security | #xss | #portswigger | #flash | #http-headers | #request-spoofing
Summary
Alex's research shows Flash can spoof HTTP headers using underscore names like User_Agent, which PHP, Perl, Ruby and ColdFusion treat as genuine. Lesson: assume any request header is spoofable.
- Published
- Collected