From 846808e5d4cc3875f2cbf95c66236f865b38545d Mon Sep 17 00:00:00 2001 From: Translator Date: Fri, 5 Sep 2025 11:19:55 +0000 Subject: [PATCH] Translated ['src/network-services-pentesting/pentesting-web/special-http --- .../pentesting-web/special-http-headers.md | 172 ++++---- .../http-request-smuggling/README.md | 389 ++++++++++-------- theme/sponsor.js | 3 +- 3 files changed, 319 insertions(+), 245 deletions(-) diff --git a/src/network-services-pentesting/pentesting-web/special-http-headers.md b/src/network-services-pentesting/pentesting-web/special-http-headers.md index 9fa61e144..97a4e40a9 100644 --- a/src/network-services-pentesting/pentesting-web/special-http-headers.md +++ b/src/network-services-pentesting/pentesting-web/special-http-headers.md @@ -1,15 +1,15 @@ -# Special HTTP headers +# Vichwa maalum vya HTTP {{#include ../../banners/hacktricks-training.md}} -## Wordlists & Tools +## Orodha za maneno & Zana - [https://github.com/danielmiessler/SecLists/tree/master/Miscellaneous/Web/http-request-headers](https://github.com/danielmiessler/SecLists/tree/master/Miscellaneous/Web/http-request-headers) - [https://github.com/rfc-st/humble](https://github.com/rfc-st/humble) -## Headers to Change Location +## Vichwa vya Kubadilisha Mahali -Rewrite **IP source**: +Rekebisha **chanzo cha IP**: - `X-Originating-IP: 127.0.0.1` - `X-Forwarded-For: 127.0.0.1` @@ -26,19 +26,20 @@ Rewrite **IP source**: - `True-Client-IP: 127.0.0.1` - `Cluster-Client-IP: 127.0.0.1` - `Via: 1.0 fred, 1.1 127.0.0.1` -- `Connection: close, X-Forwarded-For` (Check hop-by-hop headers) +- `Connection: close, X-Forwarded-For` (Angalia hop-by-hop headers) -Rewrite **location**: +Rekebisha **eneo**: - `X-Original-URL: /admin/console` - `X-Rewrite-URL: /admin/console` -## Hop-by-Hop headers +## Vichwa Hop-by-Hop -A hop-by-hop header is a header which is designed to be processed and consumed by the proxy currently handling the request, as opposed to an end-to-end header. +Kichwa cha hop-by-hop ni kichwa kilichoundwa kushughulikiwa na proxy inayoshughulikia ombi kwa sasa, badala ya kichwa cha end-to-end. - `Connection: close, X-Forwarded-For` + {{#ref}} ../../pentesting-web/abusing-hop-by-hop-headers.md {{#endref}} @@ -48,88 +49,109 @@ A hop-by-hop header is a header which is designed to be processed and consumed b - `Content-Length: 30` - `Transfer-Encoding: chunked` + {{#ref}} ../../pentesting-web/http-request-smuggling/ {{#endref}} -## Cache Headers +## Kichwa Expect -**Server Cache Headers**: +Inawezekana kwa client kutuma kichwa `Expect: 100-continue` na kisha server inaweza kujibu kwa `HTTP/1.1 100 Continue` ili kuruhusu client kuendelea kutuma body ya ombi. Hata hivyo, baadhi ya proxies hazipendi kichwa hiki. + +Matokeo ya kuvutia ya `Expect: 100-continue`: +- Kutuma ombi la HEAD lenye mwili huku server haikuzingatia kwamba maombi ya HEAD hayana mwili, na ikahifadhi muunganisho wazi hadi ulipomalizika (timeout). +- Seva nyingine zilituma data za ajabu: data za nasibu zilizosomeka kutoka soketi katika response, vitufe vya siri, au hata ikaruhusu kuzuia front-end kuondoa thamani za vichwa. +- Pia ilisababisha desync ya `0.CL` kwa sababu backend ilijibu kwa 400 badala ya 100, lakini proxy front-end ilikuwa tayari kutuma body ya ombi la awali; ikalituma na backend ikailichukulia kama ombi jipya. +- Kutuma toleo la `Expect: y 100-continue` pia kulisababisha desync ya `0.CL`. +- Hitilafu sawa ambapo backend ilijibu kwa 404 ilizalisha desync ya `CL.0` kwa sababu ombi la uharibifu liliainisha `Content-Length`, hivyo backend inatuma ombi la uharibifu + bajti za `Content-Length` za ombi linalofuata (la mwathiriwa); hili linasukuma mfululizo kwa sababu backend inatuma ombi la 404 kwa ombi la uharibifu + majibu ya ombi za mwathiriwa, lakini front-end ilifikiri ombi 1 tu lilitumwa, hivyo jibu la pili limetumwa kwa ombi la pili la mwathiriwa na jibu la hilo likatumwa kwa ombi lifuatalo... + +Kwa habari zaidi kuhusu HTTP Request Smuggling angalia: + +{{#ref}} +../../pentesting-web/http-request-smuggling/ +{{#endref}} + + +## Vichwa vya Cache + +**Vichwa vya Cache vya Server**: + +- **`X-Cache`** katika response inaweza kuwa na thamani **`miss`** wakati ombi halikuhifadhiwa (cached) na thamani **`hit`** wakati limehifadhiwa +- Tabia sawa katika kichwa **`Cf-Cache-Status`** +- **`Cache-Control`** inaonyesha kama rasilimali inahifadhiwa na lini itahifadhiwa tena: `Cache-Control: public, max-age=1800` +- **`Vary`** mara nyingi hutumika katika response kuonyesha vichwa vya ziada vinavyochukuliwa kama sehemu ya cache key hata kama kawaida havizingatiwi. +- **`Age`** inaonyesha muda kwa sekunde ambayo kitu kimekuwa kwenye proxy cache. +- **`Server-Timing: cdn-cache; desc=HIT`** pia inaonyesha kwamba rasilimali ilihifadhiwa -- **`X-Cache`** in the response may have the value **`miss`** when the request wasn't cached and the value **`hit`** when it is cached -- Similar behaviour in the header **`Cf-Cache-Status`** -- **`Cache-Control`** indicates if a resource is being cached and when will be the next time the resource will be cached again: `Cache-Control: public, max-age=1800` -- **`Vary`** is often used in the response to **indicate additional headers** that are treated as **part of the cache key** even if they are normally unkeyed. -- **`Age`** defines the times in seconds the object has been in the proxy cache. -- **`Server-Timing: cdn-cache; desc=HIT`** also indicates that a resource was cached {{#ref}} ../../pentesting-web/cache-deception/ {{#endref}} -**Local Cache headers**: +**Vichwa vya Cache vya Ndani**: -- `Clear-Site-Data`: Header to indicate the cache that should be removed: `Clear-Site-Data: "cache", "cookies"` -- `Expires`: Contains date/time when the response should expire: `Expires: Wed, 21 Oct 2015 07:28:00 GMT` -- `Pragma: no-cache` same as `Cache-Control: no-cache` -- `Warning`: The **`Warning`** general HTTP header contains information about possible problems with the status of the message. More than one `Warning` header may appear in a response. `Warning: 110 anderson/1.3.37 "Response is stale"` +- `Clear-Site-Data`: Kichwa kinachoonyesha cache ambayo inapaswa kuondolewa: `Clear-Site-Data: "cache", "cookies"` +- `Expires`: Imejaa tarehe/muda wakati response inapaswa kuisha: `Expires: Wed, 21 Oct 2015 07:28:00 GMT` +- `Pragma: no-cache` sawa na `Cache-Control: no-cache` +- `Warning`: Kichwa jumla cha HTTP **`Warning`** kina taarifa kuhusu matatizo yanayowezekana na hali ya ujumbe. Zaidi ya kichwa kimoja cha `Warning` kinaweza kuonekana katika response. `Warning: 110 anderson/1.3.37 "Response is stale"` -## Conditionals +## Masharti -- Requests using these headers: **`If-Modified-Since`** and **`If-Unmodified-Since`** will be responded with data only if the response header**`Last-Modified`** contains a different time. -- Conditional requests using **`If-Match`** and **`If-None-Match`** use an Etag value so the web server will send the content of the response if the data (Etag) has changed. The `Etag` is taken from the HTTP response. -- The **Etag** value is usually **calculated based** on the **content** of the response. For example, `ETag: W/"37-eL2g8DEyqntYlaLp5XLInBWsjWI"` indicates that the `Etag` is the **Sha1** of **37 bytes**. +- Maombi yanayotumia vichwa hivi: **`If-Modified-Since`** na **`If-Unmodified-Since`** yatatajibiwa kwa data tu ikiwa kichwa cha response **`Last-Modified`** kina wakati tofauti. +- Maombi ya masharti yanayotumia **`If-Match`** na **`If-None-Match`** yanatumia thamani ya Etag ili server itume maudhui ya response ikiwa data (Etag) imebadilika. `Etag` inachukuliwa kutoka kwa HTTP response. +- Thamani ya **Etag** kwa kawaida hupimwa kwa msingi wa **maudhui** ya response. Kwa mfano, `ETag: W/"37-eL2g8DEyqntYlaLp5XLInBWsjWI"` inaonyesha kwamba `Etag` ni **SHA1** ya **bajti 37**. -## Range requests +## Maombi ya Range -- **`Accept-Ranges`**: Indicates if the server supports range requests, and if so in which unit the range can be expressed. `Accept-Ranges: ` -- **`Range`**: Indicates the part of a document that the server should return. For example, `Range:80-100` will return the bytes 80 to 100 of the original response with a status code of 206 Partial Content. Also remember to remove the `Accept-Encoding` header from the request. -- This could be useful to get a response with arbitrary reflected javascript code that otherwise could be escaped. But to abuse this you would need to inject this headers in the request. -- **`If-Range`**: Creates a conditional range request that is only fulfilled if the given etag or date matches the remote resource. Used to prevent downloading two ranges from incompatible version of the resource. -- **`Content-Range`**: Indicates where in a full body message a partial message belongs. +- **`Accept-Ranges`**: Inaonyesha ikiwa server inasaidia maombi ya range, na ikiwa ndiyo ni kwa unit gani range inaweza kuelezwa. `Accept-Ranges: ` +- **`Range`**: Inaonyesha sehemu ya hati ambayo server inapaswa kurudisha. Kwa mfano, `Range:80-100` itarudisha bajti 80 hadi 100 za response ya asili kwa status code 206 Partial Content. Pia kumbuka kuondoa kichwa `Accept-Encoding` kutoka kwenye ombi. +- Hii inaweza kuwa muhimu kupata response yenye msimbo wa javascript unaoreflektwa kwa hiari ambao kwa kawaida ungeweza ku-escape. Lakini kwa kuabusu hii utahitaji kuingiza vichwa hivi kwenye ombi. +- **`If-Range`**: Inaunda ombi la range la masharti ambalo linautekelezwa tu ikiwa etag au tarehe iliyotolewa inafanana na rasilimali ya mbali. Inatumika kuzuia kupakua ranges mbili kutoka kwa matoleo yasiyofanana ya rasilimali. +- **`Content-Range`**: Inaonyesha wapi katika ujumbe wa mwili kamili ujumbe wa sehemu unapatikana. -## Message body information +## Taarifa za mwili wa ujumbe -- **`Content-Length`:** The size of the resource, in decimal number of bytes. -- **`Content-Type`**: Indicates the media type of the resource -- **`Content-Encoding`**: Used to specify the compression algorithm. -- **`Content-Language`**: Describes the human language(s) intended for the audience, so that it allows a user to differentiate according to the users' own preferred language. -- **`Content-Location`**: Indicates an alternate location for the returned data. +- **`Content-Length`:** Ukubwa wa rasilimali, kwa namba ya desimali ya bajti. +- **`Content-Type`**: Inaonyesha aina ya media ya rasilimali +- **`Content-Encoding`**: Inatumika kubainisha algoritim ya compression. +- **`Content-Language`**: Inaelezea lugha(za) za kibinadamu zilizokusudiwa kwa hadhira, ili kumruhusu mtumiaji kutofautisha kulingana na lugha anayoipendelea. +- **`Content-Location`**: Inaonyesha eneo mbadala kwa data iliyorejeshwa. -From a pentest point of view this information is usually "useless", but if the resource is **protected** by a 401 or 403 and you can find some **way** to **get** this **info**, this could be **interesting.**\ -For example a combination of **`Range`** and **`Etag`** in a HEAD request can leak the content of the page via HEAD requests: +Kutoka kwa mtazamo wa pentest taarifa hizi kwa kawaida ni "zisizo na maana", lakini ikiwa rasilimali imelemazwa na 401 au 403 na unaweza kupata njia yoyote ya kupata info hii, inaweza kuwa ya kuvutia.\ +Kwa mfano, mchanganyiko wa **`Range`** na **`Etag`** katika ombi la HEAD unaweza leak maudhui ya ukurasa kupitia maombi ya HEAD: -- A request with the header `Range: bytes=20-20` and with a response containing `ETag: W/"1-eoGvPlkaxxP4HqHv6T3PNhV9g3Y"` is leaking that the SHA1 of the byte 20 is `ETag: eoGvPlkaxxP4HqHv6T3PNhV9g3Y` +- Ombi lenye kichwa `Range: bytes=20-20` na kwa response yenye `ETag: W/"1-eoGvPlkaxxP4HqHv6T3PNhV9g3Y"` linaonyesha kuwa SHA1 ya bajti ya 20 ni `ETag: eoGvPlkaxxP4HqHv6T3PNhV9g3Y` -## Server Info +## Taarifa za Server - `Server: Apache/2.4.1 (Unix)` - `X-Powered-By: PHP/5.3.3` -## Controls +## Vizuizi -- **`Allow`**: Header hii inatumika kuwasilisha mbinu za HTTP ambazo rasilimali inaweza kushughulikia. Kwa mfano, inaweza kuainishwa kama `Allow: GET, POST, HEAD`, ikionyesha kwamba rasilimali inasaidia mbinu hizi. -- **`Expect`**: Inatumika na mteja kuwasilisha matarajio ambayo seva inahitaji kutimiza ili ombi kushughulikiwa kwa mafanikio. Matumizi ya kawaida ni pamoja na kichwa `Expect: 100-continue`, ambacho kinadhihirisha kwamba mteja anatarajia kutuma mzigo mkubwa wa data. Mteja anatazamia jibu la `100 (Continue)` kabla ya kuendelea na uhamishaji. Mekanism hii inasaidia kuboresha matumizi ya mtandao kwa kusubiri uthibitisho kutoka kwa seva. +- **`Allow`**: Kichwa hiki kinatumika kuwasilisha njia za HTTP ambazo rasilimali inaweza kushughulikia. Kwa mfano, kinaweza kubainishwa kama `Allow: GET, POST, HEAD`, ikionyesha kwamba rasilimali inasaidia njia hizi. +- **`Expect`**: Inatumika na client kuwasilisha matarajio ambayo server inahitaji kutimiza ili ombi lifanyike kwa mafanikio. Matumizi ya kawaida ni `Expect: 100-continue`, ambayo inaashiria kuwa client inalenga kutuma payload kubwa ya data. Client inatarajia jibu la `100 (Continue)` kabla ya kuendelea na upelelezi. Mbinu hii inasaidia kuboresha matumizi ya mtandao kwa kusubiri uthibitisho wa server. -## Downloads +## Upakuaji -- The **`Content-Disposition`** header in HTTP responses directs whether a file should be displayed **inline** (within the webpage) or treated as an **attachment** (downloaded). For instance: +- Kichwa **`Content-Disposition`** katika responses za HTTP kinaelekeza kama faili inapaswa kuonyeshwa **ndani ya ukurasa** (ndani ya webpage) au kutumika kama **kiambatisho** (kupakuliwa). Kwa mfano: ``` Content-Disposition: attachment; filename="filename.jpg" ``` -Hii inamaanisha faili iliyo na jina "filename.jpg" inakusudiwa kupakuliwa na kuhifadhiwa. +Hii inamaanisha faili iitwayo "filename.jpg" imekusudiwa kupakuliwa na kuhifadhiwa. ## Vichwa vya Usalama -### Sera ya Usalama wa Maudhui (CSP) +### Content Security Policy (CSP) + {{#ref}} ../../pentesting-web/content-security-policy-csp-bypass/ {{#endref}} -### **Aina Zinazotolewa** +### **Trusted Types** -Kwa kulazimisha Aina Zinazotolewa kupitia CSP, programu zinaweza kulindwa dhidi ya mashambulizi ya DOM XSS. Aina Zinazotolewa zinahakikisha kwamba ni vitu vilivyoundwa kwa usahihi pekee, vinavyokubaliana na sera za usalama zilizowekwa, vinaweza kutumika katika wito hatari wa API za wavuti, hivyo kulinda msimbo wa JavaScript kwa default. +Kwa kutekeleza Trusted Types kupitia CSP, maombi yanaweza kulindwa dhidi ya mashambulizi ya DOM XSS. Trusted Types zinahakikisha kwamba tu vitu vilivyotengenezwa mahsusi, vinavyokubaliana na sera za usalama zilizowekwa, vinaweza kutumika katika miito hatari ya API za wavuti, hivyo kuilinda JavaScript kwa chaguo-msingi. ```javascript // Feature detection if (window.trustedTypes && trustedTypes.createPolicy) { @@ -148,73 +170,73 @@ el.innerHTML = escaped // Results in safe assignment. ``` ### **X-Content-Type-Options** -Kichwa hiki kinazuia upimaji wa aina ya MIME, mbinu ambayo inaweza kusababisha udhaifu wa XSS. Kinahakikisha kwamba vivinjari vinaheshimu aina za MIME zilizotajwa na seva. +Kichwa hiki kinazuia MIME type sniffing, mbinu inayoweza kusababisha XSS vulnerabilities. Inahakikisha kwamba browsers zinaheshimu MIME types zilizobainishwa na server. ``` X-Content-Type-Options: nosniff ``` ### **X-Frame-Options** -Ili kupambana na clickjacking, kichwa hiki kinapunguza jinsi hati zinaweza kuingizwa katika ``, `