This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Front Range OWASP Conference 2013/Presentations/Headers"
Mark Major (talk | contribs) (Created page with "===Adventures in Large Scale HTTP Header Abuse=== While the technique of sending malicious data through HTTP Header fields is not new, there is a conspicuous lack of informat...") |
Jess Garrett (talk | contribs) |
||
| Line 8: | Line 8: | ||
Finally, the presentation will discuss defensive techniques around HTTP header abuse and how to efficiently audit a sites HTTP Header fields for vulnerabilities. | Finally, the presentation will discuss defensive techniques around HTTP header abuse and how to efficiently audit a sites HTTP Header fields for vulnerabilities. | ||
| + | |||
| + | [[Media:Wolff.pptx | Slides]] | ||
| + | [https://vimeo.com/68071431 Video] | ||
| + | <br> | ||
Latest revision as of 17:46, 11 June 2013
Adventures in Large Scale HTTP Header Abuse
While the technique of sending malicious data through HTTP Header fields is not new, there is a conspicuous lack of information on the topic.
This presentation explores research and testing results of random auditing of 1.6 million websites. The speaker will address the history of HTTP Header attacks, the logic that went into the creation of an HTTP Header Audit tool, and the most interestingly the findings of the test run.
How many vulnerable websites were discovered? What attacks were they most susceptible to? Which Header fields are most likely to be vulnerable?
Finally, the presentation will discuss defensive techniques around HTTP header abuse and how to efficiently audit a sites HTTP Header fields for vulnerabilities.
