Http tips

From Grayhat cheatsheets
Jump to navigationJump to search
  • The following downloads the contents of the folder indicated in url/

wget -r url/


  • When we access a https page, we can view information about the certificate by clicking on the green padlock symbol to the left of the address bar, and we can see things like the subject alternative name, nameservers, etc. Also sslscan (available in SPARTA) gives this kind of information.
  • If when we scan ports we find that in an http port there is an open proxy (for example, the nmap services scan says so), we need to configure the browser for using that proxy. Happens in Vulnhub's Sickos 1.1.
  • HTTP also provides mechanisms to authenticate users. There are three methods available as part of the protocol:
    • Basic Authentication: the username and password are encoded using base64 and sent using an Authorization header, for example, Authorization: basic YWRtaW46YWRtaW4K.
    • Digest Authentication: the server sends a challenge (unique information to be used), the client responds to this challenge (hash information including the password provided by the user). This mechanism prevents the password from being sent unencrypted to the server.
    • NTLM authentication: that is mostly used in the Microsoft world and is quite similar to Digest.
  • Web services are mostly a simple way to call remote methods using HTTP. It's basically a fancy way to send calls to the server and get a response back. The information sent can be:
    • Sent as with any other HTTP requests for REST.
    • Sent using XML messages for SOAP.
    • Sent using JSON-based message.
  • To bypass client side checks, you need to setup a proxy like Burp Suite.


  • There are lots of different ways to generate errors in a web application. For example, by adding some special characters, like a NULL byte (%00), a single quote (%27) or a double quote (%22) you are likely to generate errors. You can also remove a value from the HTTP request. An easy test with a PHP applications is to replace /index.php?name=hacker with /index.php?name[]=hacker.
  • Sometimes there is no need of a separator. In most cases, the separator is one of these characters: ', ", `. Injecting them (one after another) and observing the responses you get back will often give you an indication of the presence of anything suspect.
  • if you play around, you can see that <script> and </script> are filtered. One of the most basic ways to bypass these types of filters is to play with the case: if you try <sCript> and </sCRIpt> for example, you should be able to sneak the script in the page.
  • There are many ways to exploit a command injection:
    • By injecting the command inside backticks, for example `id`
    • By redirecting the result of the first command into the second, for example | id
    • By running another command if the first one succeeds: && id (where & needs to be encoded)
    • By running another command if the first one fails (and making sure it does: error || id (where error is just here to cause an error).

It's also possible to use the same value technique to perform this type of detection. For example, you can replace 123 with `echo 123`. The command inside backticks will be executed first, and return exactly the same value to be used by the command.