HTTP headers

From Grayhat cheatsheets
Jump to navigationJump to search
  • Accept: indicates the types of contents accepted as a response.
  • DNT: Do Not Track. With value "DNT: 0", it allows for personalized content, but keeps track

of us, and with value "DNT: 1" it's the opposite, better for privacy.

  • Cookie: Session identifier in a webapp. When we log in, the webapp assigns a cookie to our session, so that while it is active, our session is open (or can be opened by sending a request with this header cookie).
    • In Burp's Intruder, we can use flip bit attack, to change bit by bit the bits of a cookie. If for example we are logged in with a legit user in a webapp, and start to change the bits of the cookie. If the cookie is generated from the username with some algorithm, as we change the cookie, we may get some message like "user xxx doesn't exist". That xxx will come from the username, and if we have created a user with a name similar to "admin", and change the cookie little by little, until the user "admin" appears in the error message, we now know the cookie corresponding to the admin accoung, and can paste it in Firefox's Cookie Manager.