Difference between HTTP splitting and HTTP smuggling?

What is the main difference between HTTP splitting of HTTP smuggling?

What are the main similarities to the HTTP splitting of HTTP smuggling?

+5
source share
2 answers

HTTP splitting is the fact of splitting responses or requests into HTTP (most often responses). You have several ways to do this. Some applications will forget to prohibit end of lines in host names used in custom HTTP forwarding (30x), for example, or in past browsers, you could trick splitting requests when using end of lines in Digest HTTP DNS authentication names.

If you have such a problem (application flaws), you can create attacks that launch the end user (for example, using XSS), forcing users to request a URL, using separation to inject content in the first response and discard the normal response as an additional answer. This means that you can split the request, but also add the response content from the URL, which is a very specific combination, the URL can carry the whole attack.

But the separation can also be performed without application errors, using directly the flaw in the protocol analysis using an HTTP server (for example, double Content-Length headers). URL does not tolerate attack. Here splitting is a fact (one request or response splits after an attack), but does not have a direct effect. This is a tool.

HTTP smuggling is a more global thing that uses HTTP sharing, but not only. Without the lack of an application, in order to carry out a full smuggling attack (leading to cache poisoning or bypassing security filters), you also need transmitters, web agents such as proxies that carry the splitting attack, and targets (such as caches) that are affected split.

This post may interest you more .

+1
source

use of the weaknesses of the web application or features in the interpretation of various agents of the HTTP message. This section will analyze two different attacks that target HTTP headers:

The first attack exploits the lack of sanitation which allows an attacker to insert CR and LF characters in the response headers of the application and "split" that respond to two different HTTP messages. The purpose of the attack can range from cache poisoning to cross-site scripting.

In the second attack, the attacker exploits the fact that some specially crafted HTTP messages can be parsed and interpreted differently depending on the agent who receives them. HTTP smuggling requires a certain level of knowledge about the various agents that process HTTP messages (web server, proxies, firewalls) and therefore will only be included in the Serial Testing Unit.

https://www.owasp.org/index.php/Testing_for_HTTP_Splitting/Smuggling_(OTG-INPVAL-016)

0
source

Source: https://habr.com/ru/post/1213604/


All Articles