mirror of
https://github.com/carlospolop/hacktricks.git
synced 2023-12-14 19:12:55 +01:00
37 lines
875 B
Markdown
37 lines
875 B
Markdown
|
# Special HTTP headers
|
||
|
|
|
||
|
|
## Headers to Change Location
|
||
|
|
|
||
|
|
Rewrite **IP source**:
|
||
|
|
|
||
|
|
* `X-Originating-IP: 127.0.0.1`
|
||
|
|
* `X-Forwarded-For: 127.0.0.1`
|
||
|
|
* `X-Remote-IP: 127.0.0.1`
|
||
|
|
* `X-Remote-Addr: 127.0.0.1`
|
||
|
|
* `X-ProxyUser-Ip: 127.0.0.1`
|
||
|
|
* `X-Original-URL: 127.0.0.1`
|
||
|
|
* `Connection: close, X-Forwarded-For` \(Check hop-by-hop headers\)
|
||
|
|
|
||
|
|
Rewrite **location**:
|
||
|
|
|
||
|
|
* `X-Original-URL: /admin/console`
|
||
|
|
* `X-Rewrite-URL: /admin/console`
|
||
|
|
|
||
|
|
## Hop-by-Hop headers
|
||
|
|
|
||
|
|
A hop-by-hop header is a header which is designed to be processed and consumed by the proxy currently handling the request, as opposed to an end-to-end header.
|
||
|
|
|
||
|
|
* `Connection: close, X-Forwarded-For`
|
||
|
|
|
||
|
|
{% page-ref page="../../pentesting-web/abusing-hop-by-hop-headers.md" %}
|
||
|
|
|
||
|
|
## HTTP Request Smuggling
|
||
|
|
|
||
|
|
* `Content-Length: 30`
|
||
|
|
* `Transfer-Encoding: chunked`
|
||
|
|
|
||
|
|
{% page-ref page="../../pentesting-web/http-request-smuggling.md" %}
|
||
|
|
|
||
|
|
|
||
|
|
|