3 ms·

Is it actually possible to request most sites that way, without a host header? Maybe if it's tls and you already used sni, but I think most sites use a cdn that

Is it actually possible to request most sites that way, without a host header? Maybe if it's tls and you already used sni, but I think most sites use a cdn that uses some form of virtual hosting to share ip addresses.

1vuio0pswjnm7 6y ago
Consider the basic httpd feature of providing an automatically generated index to a directory. It is possible to locate content, including names of virtual hosts, with only an IP address.
formerly_proven 6y ago
Sure. > nc news.ycombinator.com 80 GET / HTTP/1.0 HTTP/1.1 301 Moved Permanently Server: nginx Date: Sat, 21 Nov 2020 13:59:31 GMT Content-Type: text/html Content-Length: 178 Connection: close Location: https://news.ycombinator.com/
- sokoloff 6y ago
  That is perhaps the least convincing test case you could have chosen to support your argument. (You basically proved you could fetch a content-less page, in part because that was the easiest proof case you could write, but because it didn’t demonstrate anything that an HN reader would come here for, it doesn’t resonate convincingly.)
  - formerly_proven 6y ago
    > openssl s_client -connect news.ycombinator.com:443 GET / HTTP/1.0 HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Nov 2020 17:25:28 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Cache-Control: private; max-age=0 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: origin Strict-Transport-Security: max-age=31556900 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://cdnjs.cloudflare.com/; frame-src 'self' https://www.google.com/recaptcha/; style-src 'self' 'unsafe-inline' <html lang="en" op="news"><head><meta name="referrer" content="origin"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link rel="stylesheet" type="text/css" href="news.css?jacyibSTLtogl89kgrgw"> <link rel="shortcut icon" href="favicon.ico"> <link rel="alternate" type="application/rss+xml" title="RSS" href="rss"> <title>Hacker News</title>

1vuio0pswjnm7 6y ago

Consider the basic httpd feature of providing an automatically generated index to a directory. It is possible to locate content, including names of virtual hosts, with only an IP address.

formerly_proven 6y ago

Sure. > nc news.ycombinator.com 80 GET / HTTP/1.0 HTTP/1.1 301 Moved Permanently Server: nginx Date: Sat, 21 Nov 2020 13:59:31 GMT Content-Type: text/html Content-Length: 178 Connection: close Location: https://news.ycombinator.com/

sokoloff 6y ago
That is perhaps the least convincing test case you could have chosen to support your argument. (You basically proved you could fetch a content-less page, in part because that was the easiest proof case you could write, but because it didn’t demonstrate anything that an HN reader would come here for, it doesn’t resonate convincingly.)
- formerly_proven 6y ago
  > openssl s_client -connect news.ycombinator.com:443 GET / HTTP/1.0 HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Nov 2020 17:25:28 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Cache-Control: private; max-age=0 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: origin Strict-Transport-Security: max-age=31556900 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://cdnjs.cloudflare.com/; frame-src 'self' https://www.google.com/recaptcha/; style-src 'self' 'unsafe-inline' <html lang="en" op="news"><head><meta name="referrer" content="origin"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link rel="stylesheet" type="text/css" href="news.css?jacyibSTLtogl89kgrgw"> <link rel="shortcut icon" href="favicon.ico"> <link rel="alternate" type="application/rss+xml" title="RSS" href="rss"> <title>Hacker News</title>