PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

HTTP header hacks: basic and advanced exploit techniques explored

yeswehack.com | blog | #bug-bounty | #web-security | #cache-poisoning | #http-headers | #reverse-proxy | #cpdos
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Guide to abusing HTTP headers for high-impact bugs: response header recon, custom and Vary headers, header fuzzing, Cache-Poisoned DoS on Akamai and Cloudflare, and cache collision exploits.
Published
Collected

Related coverage

vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · yeswehack.com
Cache key injection: Smuggling poison through the door
How ambiguous NGINX cache keys can enable access-control bypasses, cache deception, CPDoS, stored XSS and origin cache poisoning.
blog · yeswehack.com
How to find SSTI, cache poisoning, business logic vulnerabilities: methodology tips from top Bug Bounty hunters
Top hunters supr4s, codejump and Kto94 share methodology tips for SSTI (CWE-1336), cache poisoning (CWE-349) and business logic errors (CWE-840), from recon and tools to impact-driven exploitation.
blog · yeswehack.com
‘Hunters’ biggest mistake? Expecting immediate results’: ‘RL’ on building a Bug Bounty career
Q&A with 'RL' (Harel): starting during Covid via Hack The Box, why documentation is underrated, WAF bypass tricks, and his top find — a Glassdoor cache-poisoning bug via URL parser confusion.
Back