Create an HTTP HeaderBecause HTTP headers can originate from a Web browser, an attacker ca...

Create an HTTP Header

Because HTTP headers can originate from a Web browser, an attacker can modify the headers (called HTTP header manipulation) to create an attack. Although Web browsers do not normally allow HTTP header modification, Web services are available that allow data from a browser to be modified. One type of HTTP header attack manipulates the Referer field. In this activity, you will modify a Referer field.

1. Use your Web browser to go to www.httpdebugger.com/tools/ViewHttpHeaders.aspx to access the MadeForNet HTTP debugger, as shown in Figure.

Figure

Figure MadeForNet HTTP debugger

© Cengage Learning 2012

The location of content on the Internet, such as this program, may change without warning. If you are no longer able to access the program through the preceding URL, then use a search engine to search for “MadeForNet HTTP debugger”.

2. Under HTTP(S) URL: enter http://www.course.com.

3. Under Content Type: enter text/html.

4. Under Referer: enter http://www.google.com. This will change the referer from this current site to another site.

5. Click Submit. Note that the Referer field is changed. How could an attacker use this in an HTTP header attack?

6. Close all windows.