[WEB SECURITY] XST
Amit Klein (AKsecurity)
aksecurity at hotpop.com
Tue Mar 21 08:44:52 EST 2006
On 21 Mar 2006 at 10:31, Frederic Charpentier wrote:
> hi all,
> I am wondering if someone knowns a way to perform a xmlhttp request with
> TRACE on an iexplore 6 SP1.
> Microsoft seems to block the use of the open("TRACE",url,false").
> I saw on this list that IE can be tricked using
> open("\r\nTRACE",url,false), but it doesn't work with the http server I
> use (cisco web vpn gateway).
> So, if there's another way to do that ...
Well, you can try the technique I dubbed "HTTP Request splitting", see
"Exploiting the XmlHttpRequest object in IE - Referrer spoofing, and a lot more..." by
Try something like this:
var x = new ActiveXObject("Microsoft.XMLHTTP");
As you can see, the TRACE request is actually the SECOND request send. This technique
assumes your web server treats HT (tabs) as SPace - if the web server in question doesn't
treat HT as SP, then you're out of luck (with this technique, anyway). Also, this doesn't
grant you access to the TRACE response, but then again, you didn't ask for it ;-)
I think it can be tinkered to get access to the response, if you can arrange for the first
response to end on an IE buffer boundary (1KB - see "Divide and Conquer - HTTP Response
Splitting, Web Cache Poisoning Attacks, and Other Topics" by yours truly,
http://www.packetstormsecurity.org/papers/general/whitepaper_httpresponse.pdf, p. 19). So
you need to pad it, or possibly trim it (maybe by using Content-Range request? interesting
idea, though I never tried it), and then make sure the next request you control is sent
over the same TCP connection - and then you need to access the "response" to that request,
which is actually the TRACE response.
The Web Security Mailing List
The Web Security Mailing List Archives
More information about the websecurity