HTTP Headers For Fun & Profit

#1

Post by foobar2k » Fri, Dec 07, 2012, 10:03 AM UTC

Re: HTTP Headers For Fun & Profit

#2

Post by jorde » Fri, Dec 07, 2012, 10:22 AM UTC

Interestingly IETF discourages the use of X prefixed headers but they might still suite this kind of behavior http://tools.ietf.org/html/rfc6648

Re: HTTP Headers For Fun & Profit

#3

Post by citricsquid » Fri, Dec 07, 2012, 10:30 AM UTC

curl -I www.reddit.com

    HTTP/1.1 200 OK
    Content-Type: text/html; charset=UTF-8
    Server: '; DROP TABLE servertypes; --
    Date: Fri, 07 Dec 2012 10:30:26 GMT
    Connection: keep-alive

Re: HTTP Headers For Fun & Profit

#4

Post by nwh » Fri, Dec 07, 2012, 10:47 AM UTC

There's also a lot of fun robots.txt. I forget where it was mentioned (I didn't find it myself) but this one always made me laugh:

    # robots.txt for http://www.palm.com/ modified 7/28/09 
    User-agent: Vampires
    Disallow: /neck

Re: HTTP Headers For Fun & Profit

#5

Post by srijan4 » Fri, Dec 07, 2012, 10:47 AM UTC

curl -I www.pinboard.in

    HTTP/1.1 200 OK
    Vary: Accept-Encoding
    Content-Type: text/html; charset=utf8
    Connection: keep-alive
    Server: You got SERVED!
    X-Cache: MISS

Re: HTTP Headers For Fun & Profit

#6

Post by afandian » Fri, Dec 07, 2012, 10:50 AM UTC

What the hell is going on with those expand-on-hover boxes that you need to move your mouse to see? Who thought that was a good idea?

Re: HTTP Headers For Fun & Profit

#7

Post by dfc » Fri, Dec 07, 2012, 10:55 AM UTC

Am i getting too old? When I see "for fun and profit" I don't think I'm going to read about some easter eggs hiding in http headers.

Re: HTTP Headers For Fun & Profit

#8

Post by molf » Fri, Dec 07, 2012, 11:00 AM UTC

Here is a blog post with some classic HTTP headers (2005): http://www.nextthing.org/archives/2005/08/07/fun-with-http-h...

The cool thing is that the approach to find these unusual headers was pretty systematic.

Re: HTTP Headers For Fun & Profit

#9

Post by dfc » Fri, Dec 07, 2012, 11:01 AM UTC

jorde wrote: post #2

Interestingly IETF discourages the use of X prefixed headers but they might still suite this kind of behavior http://tools.ietf.org/html/rfc6648

I'm sorry if this is obvious. What does the verb "to suite" mean?

*I'm not trying to be pedantic, genuinely curious if it is a word I do not know.

Re: HTTP Headers For Fun & Profit

#10

Post by laumars » Fri, Dec 07, 2012, 11:04 AM UTC

afandian wrote: post #6

What the hell is going on with those expand-on-hover boxes that you need to move your mouse to see? Who thought that was a good idea?

Agreed. It took me about 30 seconds to work out how to view the content (so long I nearly gave up and closed the page.

The problem I had was that I couldn't scroll. I ended up having to maximize my browser (Opera) to read them as every time I move my mouse to the scroll bar, they'd shrink again (same problem with using the mouse scroll wheel).

I can't image trying to read those boxes on a tablet where I don't even have a cursor to hover.