11 ms·
If you ask spdycheck.org to check a site that doesn't support spdy, and customise that site's Server header to include arbitrary html, spdycheck.org will includ
by mooism2 13y ago
If you ask spdycheck.org to check a site that doesn't support spdy, and customise that site's Server header to include arbitrary html, spdycheck.org will include that header, verbatim and unescaped, in the page it presents to you (or anyone else who checks that site).
I don't know that it's a security flaw in this context, but it's sloppy.
- NKCSS 13y agoThat's a XSS then :)
- tptacek 13y agoDoes it matter? Do you actually care about your spdycheck session?
- billyhoffman 13y agoNot likely Thomas, but still, would look kind of silly for someone who spoke at BlackHat for years about JavaScript and XSS like I did to release a free tool with a DOM-based XSS... :-)
- deleted 13y ago[deleted]
- billyhoffman 13y agoAhhh. Thanks. All info from the web server, such as the protocols returned in the NPN extension and the Server header were passing through an HTML Encode function. Except there was one case where, if the site didn't support SPDY, and SPDY check could not determine the type of web server, the Server header output was not getting HTML encoded. Thanks for letting us know. Billy Hoffman (founder and CTO @ zoompf)