Slashdot stories can be listened to in audio form via an RSS feed, as read by our own robotic overlord.

 



Forgot your password?
typodupeerror

Slashdot videos: Now with more Slashdot!

  • View

  • Discuss

  • Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

×

+ - Practical HTTP Host header attacks

Submitted by Anonymous Coward
An anonymous reader writes "Trusting HTTP_HOST and its cousin SERVER_NAME has long been regarded as risky behavior. Nonetheless, plenty of popular web frameworks and applications still implicitly treat these user-supplied variables as entirely dependable. Practical HTTP Host header attacks introduces and illustrates two techniques that exploit such mistakes in Django, Joomla, Gallery and Varnish to poison caches and password reset emails alike. If only there was a canonical solution..."
This discussion was created for logged-in users only, but now has been archived. No new comments can be posted.

Practical HTTP Host header attacks

Comments Filter:

Kiss your keyboard goodbye!

Working...